CVE-2016-20097: Weaver E-cology 8.0 SQLi Vulnerability

CVE-2016-20097 Overview

CVE-2016-20097 is a SQL injection vulnerability in Weaver (Fanwei) E-cology 8.0, an enterprise collaboration platform widely deployed in Chinese enterprises. The flaw resides in the SignatureDownLoad servlet, which concatenates the markId GET parameter directly into a SQL query without sanitization. Unauthenticated remote attackers can inject a UNION SELECT payload to control the markPath value returned by the query. Because the servlet uses markPath as a filesystem path and streams the file contents back to the client, attackers can read arbitrary files accessible to the application server process, including configuration files that expose database credentials. The Shadowserver Foundation first observed exploitation activity on 2023-10-18 (UTC).

Critical Impact
Unauthenticated remote attackers can read arbitrary files from vulnerable Weaver E-cology 8.0 servers, including configuration files containing database credentials.

Affected Products

Weaver (Fanwei) E-cology 8.0
The SignatureDownLoad servlet component
Deployments where the fix has not been applied (specific fixed version is not documented in public disclosure materials)

Discovery Timeline

2023-10-18 - Shadowserver Foundation first observed exploitation activity in the wild (UTC)
2026-08-11 - CVE-2016-20097 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2016-20097

Vulnerability Analysis

The vulnerability is a classic SQL injection [CWE-89] that escalates into arbitrary file read. The SignatureDownLoad servlet accepts a markId GET parameter and inserts its value directly into a SQL statement. An attacker supplies a crafted UNION SELECT payload that returns attacker-controlled values in the markPath column. The servlet trusts the query result and opens the file located at markPath on the application server filesystem. It then streams the file contents back in the HTTP response.

Because the servlet does not require authentication, any network-reachable attacker can trigger the flaw. The impact is bounded only by the filesystem permissions of the application server process. Attackers typically target configuration files that store database connection strings, JDBC URLs, and cleartext or reversibly encoded credentials. Recovered credentials can then be used to pivot to the backing database directly.

Root Cause

The root cause is unsanitized string concatenation of user-supplied input into a SQL query, combined with implicit trust of the query result as a filesystem path. The servlet lacks parameterized queries, input validation on markId, and validation of the resolved file path against an allowlist or download directory.

Attack Vector

Exploitation requires a single HTTP GET request to the SignatureDownLoad endpoint with a crafted markId parameter. No credentials, user interaction, or prior foothold are required. The attacker constructs a UNION SELECT payload that returns a chosen filesystem path in the column used as markPath, then receives the target file contents in the HTTP response body.

Refer to the VulnCheck Security Advisory and the Seebug Vulnerability Entry for further technical details.

Detection Methods for CVE-2016-20097

Indicators of Compromise

HTTP GET requests to URIs containing SignatureDownLoad with a markId parameter that includes SQL keywords such as UNION, SELECT, FROM, or URL-encoded equivalents (%20UNION%20SELECT).
Access log entries where the SignatureDownLoad servlet returns unusually large responses or non-image binary content.
Outbound access to sensitive local paths referenced in returned data, or subsequent database logins from unexpected source IPs using credentials found in configuration files.

Detection Strategies

Deploy WAF or reverse-proxy rules that inspect the markId parameter for SQL metacharacters and UNION SELECT sequences.
Alert on any request to SignatureDownLoad from source addresses outside the expected user population, especially unauthenticated sessions.
Correlate application server access logs with database credential use to detect post-exploitation lateral movement.

Monitoring Recommendations

Forward Weaver E-cology application server logs and web access logs into a centralized SIEM for retrospective hunting against the request patterns above.
Monitor the application server process for reads of sensitive configuration files (for example weaver.properties, JDBC configuration files) outside of startup routines.
Track outbound connections from database hosts to identify credential-based follow-on access originating from compromised E-cology deployments.

How to Mitigate CVE-2016-20097

Immediate Actions Required

Restrict network access to the Weaver E-cology 8.0 web interface so that only trusted internal networks or VPN clients can reach the SignatureDownLoad endpoint.
Block or rate-limit requests to SignatureDownLoad that contain SQL keywords in the markId parameter using a WAF.
Rotate any database credentials, service account passwords, and secrets stored in E-cology configuration files, assuming they may already be exposed.
Audit web access logs since 2023-10-18 for exploitation attempts matching the indicators above.

Patch Information

Weaver's disclosure materials indicate that the vulnerability has been remediated, but the specific fixed version is not published. Administrators should consult the Weaver Security Download Page and the Weaver Full Log Analysis to obtain the latest available patches and apply the most recent E-cology 8.0 update. Contact Weaver support directly to confirm that the deployed build includes the SignatureDownLoad fix.

Workarounds

Block external access to the SignatureDownLoad servlet at the reverse proxy or WAF layer until the patched build is confirmed installed.
Enforce strict input validation on the markId parameter, rejecting values that are not numeric or that contain SQL metacharacters.
Run the application server under a low-privilege account with filesystem permissions restricted to the E-cology deployment directory, limiting the scope of arbitrary file read.
Store database credentials in an external secret store or use OS-level file permissions to keep configuration files unreadable by unnecessary users.

bash

# Example nginx reverse-proxy rule to block SQLi patterns on SignatureDownLoad
location ~* /SignatureDownLoad {
    if ($arg_markId ~* "(union|select|from|--|/\*|%20union|%27)") {
        return 403;
    }
    proxy_pass http://ecology_backend;
}