CNVD-2022-43245 Scanner

Weaver e-office is a collaborative mobile office platform widely used by enterprises to enhance productivity and streamline office work through digital solutions. It offers a suite of features including document management, workflow automation, and team collaboration tools. Primarily targeted at business users, Weaver e-office aims to increase efficiency and provide flexible work environments. Its integration capabilities allow for seamless operation across various business processes. Organizations use it to manage tasks, resources, and communications effectively. The platform's user-friendly interface is designed to support diverse operational requirements in modern office environments.

The Arbitrary File Read vulnerability in Weaver e-office allows attackers to access sensitive files stored on the server without authorization. Such vulnerabilities can lead to significant security breaches, especially if exploited to obtain confidential data. By sending specially crafted HTTP requests, malicious entities can manipulate file access endpoints. This vulnerability highlights fundamental weaknesses in input validation and access controls. Exploitable via network access, it remains a high-risk issue for unpatched installations.

Specifically, the vulnerability resides in the file download or preview functionality, where the application fails to properly sanitize user-supplied file paths. An attacker can manipulate parameters such as 'filePath' or 'fileName' to traverse directories and read arbitrary files. This includes configuration files, database credentials, and other sensitive data. The endpoint typically processes requests without adequate authorization checks, allowing unauthenticated or low-privileged users to exploit it.

If exploited, an attacker can exfiltrate sensitive information like system configuration, user credentials, and proprietary business data. This could lead to further attacks, such as privilege escalation or lateral movement within the network. The impact is severe, potentially compromising the entire organization's security posture. Immediate remediation is critical to prevent data breaches and maintain compliance with security standards.