Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability allows unauthenticated attackers to upload and execute malicious files on affected Weaver E-office systems. This could lead to full compromise of the web server.
- Remote code execution is possible.
- Business operations could be disrupted.
- Attacks can be performed over the internet.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this vulnerability by uploading a webshell to the server. This allows them to execute arbitrary code as the web server user, leading to full system compromise.
- Remote attackers can abuse this.
- Target is the OfficeServer.php endpoint.
- Upload webshells to Document directory.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows unauthenticated attackers to upload webshells, enabling remote code execution on internet-facing Weaver E-office servers. Exploitation was observed in late 2022, indicating a clear threat to systems running unpatched versions.
- Observed exploitation in 2022.
- No public exploit availability noted.
- No KEV listing signal.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize investigating Weaver E-office instances for the unauthenticated arbitrary file upload vulnerability, as exploitation evidence has been observed. Given the critical severity and observed exploitation, consider isolating affected services if immediate patching is not feasible.
- Block multipart POST requests to OfficeServer.php.
- Monitor for webshell execution via HTTP GET requests.
- Update Weaver E-office to version 10.0_20221201 or later.
