CVE-2020-37278

Executive Summary

CVE-2020-37278 is an unauthenticated arbitrary file read vulnerability in Weaver e-Bridge, a Chinese enterprise collaboration and workflow platform. A remote attacker can supply a file: URL to the downloadUrl parameter of the saveYZJFile endpoint to read arbitrary files on the host, including /etc/passwd and configuration or credential files; the same endpoint's handling of http(s) URLs enables server-side request forgery (SSRF) against internal network resources. The vulnerability carries a CVSS v3.1 score of 7.5 (High), requires no authentication or user interaction, and remains unpatched according to all tracked sources, with in-the-wild exploitation activity first observed by the Shadowserver Foundation on 2023-10-17.

Technical Analysis

The vulnerability is classified as CWE-918 (Server-Side Request Forgery), although its practical impact combines two distinct weaknesses within a single endpoint: an unauthenticated arbitrary file read and a broader SSRF capability. Both stem from insufficient validation of a user-supplied URL passed to the downloadUrl parameter of the saveYZJFile endpoint.

The mechanism is as follows. The saveYZJFile endpoint accepts a downloadUrl parameter intended to reference a remote resource that the server retrieves and saves on the caller's behalf. Because the application fails to validate or restrict the URL scheme and target, an attacker can substitute a file: URL. The server-side URL handler then resolves that file: URI against the local filesystem and returns the contents of the referenced path to the unauthenticated requester. This converts a routine "download and save" function into an arbitrary file disclosure primitive. No authentication is enforced on the endpoint, so the attacker needs only network reachability to the e-Bridge service.

The same parameter accepts http(s) URLs, which extends the primitive into classic SSRF. The server will issue outbound HTTP requests to attacker-chosen destinations. An attacker can therefore probe internal-only services, reach cloud metadata endpoints, interact with internal APIs, or use the e-Bridge host as a pivot into segmented networks that are not directly reachable from the internet. Because the server returns the fetched content, the SSRF is of the "full read" variety rather than blind, materially increasing its value to an attacker.

The NVD description does not disclose the underlying mapping that causes a single endpoint to accept both file: and http(s) schemes — for example, whether the application uses a generic URL-fetch library without an allowlist. No code-level detail beyond the endpoint name, parameter name, and observed scheme behavior is available. The vulnerability class, however, is unambiguous: user-controlled URL scheme and destination without validation, leading to local file read and server-side request forgery. The CVSS subscores reflect this profile — Network attack vector, Low complexity, no Privileges or User Interaction required, Unchanged scope, and High confidentiality impact with no integrity or availability impact (C:H/I:N/A:N). The temporal exploitation evidence (Shadowserver observation date) indicates the weakness is practical, not theoretical.

Exploitation Scenarios

No public proof-of-concept is available, and the attack chain below is inferred from the vulnerability class and the endpoint behavior described in the NVD entry. Specific internal function names, alternate parameters, or code paths beyond those named in the description are not asserted.

1. Reconnaissance and target identification. The attacker identifies internet-exposed Weaver e-Bridge instances. This is typically done through internet scanning services queried for the product's fingerprint (for example using product or page-title dorks) or through broad scanning of e-Bridge HTTP responses. The attacker confirms the host runs e-Bridge and that the saveYZJFile endpoint is reachable. No credentials are required for this step.

2. Triggering the flaw. With the endpoint reachable, the attacker sends a request to saveYZJFile supplying a downloadUrl value using the file: scheme, pointing at a target path on the host (for example /etc/passwd, a configuration file, or an application credential file). Because the parameter is not validated and the endpoint is unauthenticated, the server resolves the URI locally and returns the file contents in the response.

3. Execution method (vulnerability-class level). This is a parameter-injection-style attack against a URL-fetching function: the attacker controls the scheme and destination of a URL that the server dereferences on its own behalf. Variants of the same request substitute an http(s) URL as the downloadUrl value, causing the server to issue an outbound request to an attacker-selected destination and return the response body — a full-read SSRF. No code execution is involved; the primitive is reading data the server can already access.

4. Post-exploitation impact. The attacker harvests sensitive files: user account data, application configuration, and credential material stored on the host. The SSRF capability allows enumeration and access of internal services — databases, admin interfaces, and cloud metadata endpoints — that are not directly exposed to the internet, enabling lateral movement and privilege escalation within the internal network. Because exploitation leaves the server performing ordinary outbound fetches, it can be difficult to distinguish from benign traffic without URL-parameter monitoring.

The Shadowserver Foundation's observation of exploitation evidence on 2023-10-17 confirms that the endpoint is actively targeted on the public internet, and this activity predates any evidence of a vendor patch.

Impact Assessment

The CVSS v3.1 base score is 7.5 (High), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The subscores drive the business impact: Network attack vector and Low attack complexity mean any internet-reachable instance is trivially attackable at scale; no Privileges Required and no User Interaction mean unauthenticated attackers and opportunistic scanners alike can exploit it. Scope is Unchanged — the vulnerable e-Bridge component remains the security authority, though the SSRF capability can reach beyond it into internal networks. Confidentiality impact is High, reflecting exposure of arbitrary files and internal service responses; Integrity and Availability impact are None, so the vulnerability is a pure disclosure and pivot primitive rather than a destructive one.

Blast radius depends on deployment. An internet-exposed e-Bridge host can leak: (a) local filesystem contents, including /etc/passwd and configuration/credential files referenced in the description; (b) responses from internal-only HTTP services reachable from the e-Bridge server; and potentially (c) cloud instance metadata if the host runs in a cloud environment. Credential material recovered from configuration files can be reused against downstream systems, turning a single unauthenticated file read into broader compromise. Because the endpoint is unauthenticated and the request is low-complexity, mass exploitation is feasible, and the observed Shadowserver exploitation evidence indicates this is occurring in practice. There is no CISA KEV listing and no EPSS score from FIRST.org at the time of writing, but neither should be read as evidence of low risk given confirmed in-the-wild activity.

Detection Guidance

Sigma Rule

title: Weaver e-Bridge saveYZJFile Arbitrary File Read and SSRF Attempt
id: 8f2c1a44-7b19-4e3d-9c5a-1d6e2f7a4b90
status: experimental
description: Detects requests to the Weaver e-Bridge saveYZJFile endpoint carrying a downloadUrl parameter using file or http(s) schemes, indicating arbitrary file read or SSRF.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2020-37278
author: valtersit.com
date: 2024/01/01
tags:
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|endswith: '/saveYZJFile'
  selection_param:
    cs-uri-query|contains:
      - 'downloadUrl=file:'
      - 'downloadUrl=file%3A'
      - 'downloadUrl=http:'
      - 'downloadUrl=https:'
      - 'downloadUrl=http%3A'
      - 'downloadUrl=https%3A'
  condition: selection_endpoint and selection_param
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
falsepositives:
  - Legitimate administrative use of the endpoint with http(s) URLs
level: high

YARA Rule

rule CVE_2020_37278_Weaver_eBridge_saveYZJFile
{
    meta:
        description = "Detects references to the Weaver e-Bridge saveYZJFile endpoint and downloadUrl parameter associated with CVE-2020-37278 arbitrary file read and SSRF"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2020-37278"
        author = "valtersit.com"
        date = "2024-01-01"
        severity = "high"

    strings:
        $ep1 = "saveYZJFile" ascii wide nocase
        $p1  = "downloadUrl" ascii wide nocase
        $f1  = "file:///" ascii wide
        $f2  = "file:/" ascii wide
        $f3  = "file%3A" ascii wide nocase

    condition:
        $ep1 and ($p1 or any of ($f*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2020-37278 Weaver e-Bridge saveYZJFile Arbitrary File Read / SSRF Attempt"; flow:established,to_server; http.uri; content:"saveYZJFile"; nocase; http.uri; content:"downloadUrl="; nocase; pcre:"/(downloadUrl|downloadUrl%3D)=(file%3A|file:|http%3A|http:|https%3A|https:)/i"; classtype:web-application-attack; reference:cve,2020-37278; reference:url,nvd.nist.gov/vuln/detail/CVE-2020-37278; sid:202037278; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [network where url.path : "*saveYZJFile*" and url.query : "*downloadUrl*"]
  [network where url.query regex~ ".*downloadUrl=(file%3A|file:|http%3A|http:|https%3A|https:).*"]

Splunk SPL Query

index=web OR index=proxy
| eval uri=coalesce(uri, cs_uri_stem, url, request)
| eval qs=coalesce(query, cs_uri_query, cs_uri_query)
| where like(uri, "%saveYZJFile%")
| where match(qs, "(?i)downloadUrl=(file%3A|file:|http%3A|http:|https%3A|https:)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, qs
| sort - count

Wazuh OSSEC Rule

<group name="weaver,ebridge,web,cve-2020-37278,">
  <rule id="100378" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>saveYZJFile</url>
    <regex type="pcre2">(?i)downloadUrl=(file%3A|file:|http%3A|http:|https%3A|https:)</regex>
    <description>CVE-2020-37278: Weaver e-Bridge saveYZJFile arbitrary file read or SSRF attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4: no patch evidence exists from any tracked source, no vendor advisory or fix version is identified, and affected version ranges are unknown. No vendor-supplied workaround is available. Treat the product as unpatched and act on compensating controls.

1. Immediate mitigations. Remove or restrict internet exposure of Weaver e-Bridge. If the service must remain reachable, place it behind an authenticating reverse proxy or VPN and restrict source IP ranges to known users. Block requests to the saveYZJFile endpoint that carry a downloadUrl parameter using a file: scheme, and — where the business flow does not require it — block http(s) targets as well; enforce this at a WAF or reverse proxy, since the application itself performs no validation. Apply egress filtering on the e-Bridge host so that outbound HTTP requests can only reach explicitly permitted destinations, which limits the SSRF blast radius, and deny the server access to cloud instance metadata endpoints. Because the flaw is an unauthenticated read, ensure host-level sensitive files (configuration, credential stores) are not readable by the e-Bridge service account, and roster and rotate any credentials that reside on or are reachable from the host.

2. Patch/upgrade steps. No patch is available. Monitor the vendor's channel for a fixed release and, in the interim, do not rely on version upgrades as a remediation. Re-evaluate exposure immediately if an advisory appears, and verify any future fix by confirming the endpoint rejects non-allowlisted URL schemes.

3. Long-term hardening. Adopt an allowlist-based URL fetch design for any server-side download functionality, validating scheme and destination before dereferencing, and reject file: and internal-only addresses by default. Segment the e-Bridge deployment so compromised hosts cannot reach sensitive internal services, and enforce least privilege on the service account. Add the detection rules above to the SOC and alert on downloadUrl scheme abuse at the proxy and WAF layers rather than relying on application logs alone.

References

• NVD — CVE-2020-37278: https://nvd.nist.gov/vuln/detail/CVE-2020-37278
• CWE-918, Server-Side Request Forgery (SSRF): https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK T1190, Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
• Shadowserver Foundation — exploitation evidence for CVE-2020-37278 first observed 2023-10-17 (per NVD description)