CVE-2022-4995: Weaver E-cology 9.0 RCE Vulnerability

CVE-2022-4995 Overview

CVE-2022-4995 is an unrestricted file upload vulnerability [CWE-434] in Weaver (Fanwei) E-cology 9.0 prior to version 10.52. The affected endpoint /workrelate/plan/util/uploaderOperate.jsp accepts multipart/form-data POST requests without authentication and without validating uploaded file types. A remote attacker can upload a JSP webshell by supplying arbitrary secId and plandetailid field values. Successful exploitation grants remote code execution under the privileges of the application server process. The Shadowserver Foundation first observed exploitation activity on 2023-10-14 (UTC).

Critical Impact
Unauthenticated remote code execution on Weaver E-cology 9 collaboration servers via arbitrary JSP webshell upload.

Affected Products

Weaver (Fanwei) E-cology 9.0 versions prior to 10.52
Deployments exposing /workrelate/plan/util/uploaderOperate.jsp
Java application servers hosting vulnerable E-cology instances

Discovery Timeline

2023-10-14 - Exploitation activity first observed by the Shadowserver Foundation
2026-08-07 - CVE-2022-4995 published to NVD
2026-08-07 - Last updated in NVD database

Technical Details for CVE-2022-4995

Vulnerability Analysis

The flaw resides in the uploaderOperate.jsp handler within the workrelate/plan/util/ path of Weaver E-cology 9. The JSP processes multipart/form-data uploads without enforcing authentication, session validation, or file extension controls. Attackers submit a POST request containing an arbitrary secId parameter, an arbitrary plandetailid parameter, and a file payload with a .jsp extension. The handler writes the file to a web-accessible directory under the application server root. The server then interprets subsequent HTTP requests to the uploaded file as executable JSP, giving the attacker command execution under the identity of the servlet container process.

See the VulnCheck Security Advisory and the Ch0x01e Analysis of Ecology9 for technical details.

Root Cause

The uploaderOperate.jsp endpoint fails to implement three controls simultaneously: authentication checks on the incoming request, allowlist-based validation of the uploaded file's extension and MIME type, and restriction of the destination directory from web execution. This combination maps directly to [CWE-434] Unrestricted Upload of File with Dangerous Type.

Attack Vector

Exploitation requires network access to the E-cology web interface and no user interaction. An attacker crafts a single multipart/form-data POST request targeting /workrelate/plan/util/uploaderOperate.jsp with arbitrary values for secId and plandetailid and a JSP webshell as the file body. The attacker then requests the uploaded JSP URL to invoke commands. A public proof-of-concept is available in the GitHub PoC repository.

// No verified exploit code included. See linked references for PoC details.

Detection Methods for CVE-2022-4995

Indicators of Compromise

POST requests to /workrelate/plan/util/uploaderOperate.jsp from external or unexpected source IPs.
Newly created .jsp, .jspx, or .jsp.* files under E-cology web directories, especially under workrelate/plan/.
Application server process (Tomcat, WebLogic, Resin) spawning cmd.exe, powershell.exe, /bin/sh, or whoami.
Outbound connections from the E-cology host to unfamiliar IPs following a POST to the vulnerable endpoint.

Detection Strategies

Alert on HTTP POST requests to uploaderOperate.jsp where the Content-Type is multipart/form-data and the response status is 200.
Correlate file-write events for .jsp files under the web root with preceding HTTP POST logs.
Deploy YARA or content signatures for common JSP webshell patterns such as Runtime.getRuntime().exec combined with request.getParameter.

Monitoring Recommendations

Forward web server access logs and application server logs to a central SIEM for correlation.
Monitor child process creation on Java application server hosts and treat shell spawns as high severity.
Baseline the file inventory of the E-cology web directory and alert on additions.

How to Mitigate CVE-2022-4995

Immediate Actions Required

Upgrade Weaver E-cology 9 to version 10.52 or later using the Weaver Security Resources Download portal.
Block external access to /workrelate/plan/util/uploaderOperate.jsp at the reverse proxy or WAF until patched.
Audit the web root for unauthorized .jsp files and remove any webshells found.
Rotate credentials, keys, and session tokens accessible from the E-cology host if compromise is suspected.

Patch Information

Weaver addresses the vulnerability in E-cology 9.0 build 10.52 and later. Consult the Weaver Ecology Full Log for release notes and the Weaver Security Resources Download page for patches.

Workarounds

Restrict access to the E-cology management interface to trusted internal networks or VPN clients.
Configure the reverse proxy to deny POST requests to /workrelate/plan/util/uploaderOperate.jsp.
Configure the servlet container to prevent execution of JSP files within upload directories.
Enforce authentication on all uploaderOperate.jsp endpoints via a filter or WAF rule.

bash

# Example nginx rule to block the vulnerable endpoint
location ~* /workrelate/plan/util/uploaderOperate\.jsp$ {
    return 403;
}