CVE-2023-2523 Threat Intelligence Report

Executive Summary

CVE-2023-2523 is a critical unrestricted file upload vulnerability in Weaver E-Office 9.5, affecting an unknown functionality within the App/Ajax/ajax.php?action=mobile_upload_save endpoint. The vulnerability allows remote attackers to upload arbitrary files through manipulation of the upload_quwan argument, potentially leading to remote code execution on the target server. The exploit has been publicly disclosed and is already leveraged in the wild with a high EPSS percentile (98.2%), indicating active exploitation. No patch is currently available from the vendor, who did not respond to disclosure attempts.

Technical Analysis

Weaver E-Office is an enterprise office automation platform widely deployed across Chinese organizations and other regions, designed to manage internal workflows, document management, messaging, and collaboration. The product's mobile upload functionality is exposed through the PHP script App/Ajax/ajax.php, which handles various AJAX requests, including file uploads from mobile clients.

The vulnerability exists in the mobile_upload_save action of the App/Ajax/ajax.php endpoint. When the upload_quwan argument is manipulated, the application fails to properly validate the file type and content before saving the uploaded file to the server. This constitutes a classic unrestricted file upload vulnerability (CWE-434).

The attack mechanism is as follows:

1. Insufficient file type validation — The application does not verify that the uploaded file extension/content-type matches an allowed list (e.g., images only). An attacker can upload a .php, .jsp, .aspx, or other executable file type.

2. Insufficient content inspection — The application does not inspect the file's MIME type, magic bytes, or content. An attacker can embed a web shell payload within a file that appears benign (e.g., double extension shell.php.jpg) or passes client-side filters via request interception.

3. Direct file access — Once uploaded, the file is stored within the web root. An attacker can execute the uploaded script by directly requesting the file's URL path, achieving remote code execution with the privileges of the web server process (typically www-data or IIS_APPPOOL).

The exact implementation details of the upload handling, including where files are stored and whether any intermediate sanitization exists, have not been fully documented in public disclosures. The vendor's non-response to the disclosure further limits available technical specifics. However, the vulnerability class is well-understood: unrestricted upload combined with a publicly accessible web root creates a direct path to code execution.

The endpoint is located at App/Ajax/ajax.php?action=mobile_upload_save — this path is confirmed in the NVD description. The vulnerable argument is upload_quwan. No other implementation details have been confirmed, and additional file paths, storage directories, or authentication requirements have not been publicly documented.

Exploitation Scenarios

Based on the NVD description and the vulnerability class (unrestricted upload), the following attack chain is inferred:

Step 1: Reconnaissance / Target Identification

• Attackers scan for exposed Weaver E-Office instances using Shodan, FOFA, or similar search engines with fingerprints like "E-Office" Weaver or specific login pages/default ports.
• The target is identified as running E-Office version 9.5 (or potentially similar builds affected by the same code path).

Step 2: Triggering the Vulnerability

• No authentication assumed: The NVD description indicates the attack may be launched remotely without specifying authentication requirements. This suggests the mobile_upload_save action may be accessible without authentication, or the attacker has obtained low-privileged credentials.
• The attacker sends an HTTP POST request to App/Ajax/ajax.php?action=mobile_upload_save with the upload_quwan argument containing a file.
• The request is crafted to upload a file with an executable extension (e.g., .php) or a double-extension bypass (e.g., shell.php.jpg) depending on the application's validation logic (which is unknown and may be weak or absent).

Step 3: Payload Execution

• The file is saved to a path within the web root. The attacker locates the uploaded file by:
  • Guessing standard upload paths (e.g., /uploads/, /files/, /attachment/ — not confirmed in public data).
  • Observing the response from the server which may leak the file path or URL.
  • Correlating with the public PoC if available (PoC status: Public per the data).
• Once located, the attacker sends an HTTP GET request to the uploaded file's URL. If the file is a web shell (e.g., PHP script with exec functions), the attacker executes arbitrary commands on the server.

Step 4: Post-Exploitation Impact

• Remote code execution as the web server user.
• Lateral movement potential: The web server may have access to internal databases (e.g., MySQL) creds in config files, internal network segments, or corporate Active Directory (if the server is domain-joined).
• Full compromise of the E-Office application data — access to enterprise workflows, documents, employee PII, and internal communications.
• Potential for ransomware deployment or data exfiltration given the sensitive nature of office automation systems.

Important: Specific details on the exact file path, bypass techniques, or multi-step exploitation chains are not available in publicly disclosed data. The attack chain is inferred from the vulnerability class and confirmed technical details from the NVD description. No public full PoC exploit code has been confirmed available in this dataset (Exploit Code: NO), though the exploit has been "disclosed to the public."

Impact Assessment

CVSS Score: 7.3 (High)

Key considerations:

• Attack Vector: Network (AV:N) — Remotely exploitable without physical access.
• Attack Complexity: Low (AC:L) — The vulnerability is straightforward to trigger via HTTP request manipulation.
• Privileges Required: Low or None (PR:L or PR:N) — Inferred from description; if unauthenticated, severity increases.
• User Interaction: None (UI:N) — No victim action required.
• Confidentiality Impact: High (C:H) — Achieves code execution, leading to full data exposure.
• Integrity Impact: High (I:H) — Attacker can modify/delete files, plant backdoors, alter application behavior.
• Availability Impact: Low (L) — Code execution could enable denial-of-service (e.g., deleting files, killing processes) but is not the primary impact.

Business Impact:

Affected Systems: Weaver E-Office 9.5 (precise affected version range unknown; other versions may share the vulnerable code path). Given the vendor's non-response, impacted systems may extend beyond 9.5.

Blast Radius: Web server compromise → potential lateral movement → domain-level compromise if credentials are reused or contains AD access. Considered high due to the lack of patch availability.

Detection Guidance

The following detection rules target exploitation attempts against CVE-2023-2523 based on the confirmed technical details: the request to App/Ajax/ajax.php with action=mobile_upload_save and the upload_quwan parameter.

Sigma Rule

title: Weaver E-Office Unrestricted Upload Attempt (CVE-2023-2523)
id: 8f3d2a1e-5c14-4a7b-8f61-9021c34a7b11
status: experimental
description: Detects attempts to exploit unrestricted file upload in Weaver E-Office via App/Ajax/ajax.php
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-2523
author: ValtersIT Threat Intelligence
date: 2025/01/15
logsource:
    category: webserver
    product: generic
detection:
    selection_uri:
        cs-method: POST
        cs-uri-query|contains:
            - 'App/Ajax/ajax.php'
            - 'action=mobile_upload_save'
            - 'upload_quwan'
    selection_extensions:
        cs-uri-query|contains:
            - '.php'
            - '.jsp'
            - '.aspx'
            - '.phtml'
            - '.php5'
    condition: selection_uri and selection_extensions
    timeframe: 5m
    threshold: 1
fields:
    - c-ip
    - cs-uri-query
    - cs-user-agent
falsepositives:
    - Legitimate file uploads of images to the mobile upload feature
level: high
tags:
    - attack.t1190
    - cve.2023-2523
    - cwe.434

YARA Rule

rule Weaver_E_Office_Unrestricted_Upload_CVE_2023_2523
{
    meta:
        author = "ValtersIT Threat Intelligence"
        description = "Detects HTTP requests targeting the mobile_upload_save action in Weaver E-Office"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-2523"
        cve = "CVE-2023-2523"
        date = "2025-01-15"
    strings:
        $ajax_path = "App/Ajax/ajax.php" ascii wide nocase
        $action = "action=mobile_upload_save" ascii wide nocase
        $param = "upload_quwan" ascii wide nocase
        $php_ext = ".php" ascii wide nocase
        $shell_code = "<?php" ascii wide nocase
        $exec = "system(" ascii wide nocase
        $cmd = "cmd" ascii wide nocase
    condition:
        uint16(0) == 0x0D0A or uint16(0) == 0x0A0D or
        ($ajax_path and $action and $param and
         (#php_ext > 0 or $shell_code or $exec or $cmd))
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg: "ET EXPLOIT Weaver E-Office Unrestricted Upload Attempt (CVE-2023-2523)";
    flow: established, to_server;
    http.method: "POST";
    http.uri: contains "App/Ajax/ajax.php";
    http.uri: contains "action=mobile_upload_save";
    http.uri: contains "upload_quwan";
    http.file_name: re(b"\.(php|php5|phtml|jsp|aspx)$");
    classtype: attempted-admin;
    sid: 202500001;
    rev: 1;
    metadata: created_at 2025-01-15, cve CVE-2023-2523, cwe CWE-434, severity high;
)

Elastic Detection

sequence by source.ip
  [network where event.category == "network" and network.protocol == "http" and
   http.request.method == "POST" and
   url.path contains "App/Ajax/ajax.php" and
   url.query contains "action=mobile_upload_save" and
   url.query contains "upload_quwan"]
  [file where event.action == "create" and
   (file.extension == "php" or file.extension == "php5" or file.extension == "phtml" or
    file.extension == "jsp" or file.extension == "aspx")]

Splunk SPL Query

index=web OR index=proxy sourcetype=iis OR sourcetype=apache OR sourcetype=access_combined
| where HTTP_METHOD="POST" AND 
        (like(URI, "%App/Ajax/ajax.php%") OR like(URI, "%action=mobile_upload_save%") OR 
         like(URI, "%upload_quwan%"))
| regex URI="(?i)(\.php|\.php5|\.phtml|\.jsp|\.aspx)"
| stats count by clientip, URI, status, useragent, _time
| sort - count
| table _time, clientip, URI, status, useragent, count

Wazuh OSSEC Rule

<group name="weaver_eoffice,">
  <rule id="100001" level="15">
    <if_sid>31100</if_sid>
    <field name="url">\.*App/Ajax/ajax\.php.*</field>
    <field name="url">\.*action=mobile_upload_save.*</field>
    <field name="url">\.*upload_quwan.*</field>
    <description>Weaver E-Office unrestricted upload attempt (CVE-2023-2523)</description>
    <group>cve-2023-2523,wazuh,webserver,</group>
    <options>no_full_log</options>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100002" level="15">
    <if_sid>100001</if_sid>
    <regex>(?i)\.(php|php5|phtml|jsp|aspx)\b</regex>
    <description>Potential webshell upload to Weaver E-Office - suspicious extension in request</description>
    <group>cve-2023-2523,webshell,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED No patch has been confirmed available from Weaver. The vendor did not respond to the initial disclosure, and no security advisory or update has been released (as of this report).

1. Immediate Mitigations (Compensating Controls)

⚠ Critical: Without a patch, immediate protective measures are essential.

• Block Access to Vulnerable Endpoint: Configure WAF rules or reverse proxy ACLs to block HTTP POST requests to App/Ajax/ajax.php where the query string contains action=mobile_upload_save. Consider blocking all direct access to this file unless explicitly required for legitimate mobile functionality.
• Restrict File Upload Types: If the mobile upload feature is required, implement strict server-side validation:
  • Whitelist allowed file extensions (e.g., .jpg, .png, .gif, .docx).
  • Validate MIME types against actual file content (magic bytes).
  • Reject double extension files (e.g., .php.jpg).
• Application-Layer Firewall: Deploy a WAF rule to block requests containing the upload_quwan parameter with suspicious file extensions.
• Network Segmentation: Isolate the E-Office server from internal critical systems to limit lateral movement.
• Web Server Hardening:
  • Disable PHP execution in upload directories (php_flag engine off in .htaccess for Apache, or equivalent).
  • For IIS, disable script mapping for upload paths.
• Monitoring: Enable the detection rules above to catch exploitation attempts in progress.

2. Patch/Upgrade Steps

• Vendor Monitoring: Monitor Weaver's official website/security advisory page (https://www.weaver.com.cn — if applicable) for any emergency advisory or patch release.
• Contact Vendor: Attempt to reach vendor security contacts via alternative channels (regional office, partner network).
• Version Upgrade: When Weaver releases a patched version (expected version ≥ 9.5.x with fix), upgrade immediately. If in-place upgrade is not possible, consider re-architecting to a patched cloud-based alternative.
• No Current Solution: As of this report, there is no known patched version. Do not assume a fix exists in any interim build unless explicitly verified.

3. Long-Term Hardening

• Harden Upload Handling: If migrating/rewriting, implement:
  • Randomized file storage paths not accessible via direct URL.
  • Serve files through a proxy/download script that enforces access control.
  • Content Security Policy (CSP) headers to restrict script execution.
• Harden Web Server Deployment:
  • Run web server with least-privilege service account.
  • Disable dangerous PHP functions (e.g., exec, system, passthru) via disable_functions.
  • Keep PHP/relevant runtime up to date.
• Permanent Monitoring: Add persistent detection rules for this CVE and monitor for any variant upload attempts.
• Asset Discovery: Identify all Weaver E-Office installations in your environment; this CVE may affect other versions sharing the same codebase.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-2523
2. VDB-228014 (VulDB): https://vuldb.com/?id.228014
3. CVE.org Record: https://www.cve.org/CVERecord?id=CVE-2023-2523
4. Chinese National Vulnerability Database (if available): https://www.cnvd.org.cn/ (search for Weaver E-Office)
5. EPSS Score Reference: https://www.first.org/epss/ (CVE-2023-2523; EPSS 0.32895, 98.2% percentile)

Threat Actor Campaigns / Exploitation in the Wild:

• No specific APT group or ransomware gang has been officially attributed to exploiting CVE-2023-2523 as of this report's date.
• The EPSS percentile of 98.2% indicates active exploitation attempts are being observed in the wild.
• The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of this report (CISA KEV: NO).
• Given Weaver E-Office's popularity in Chinese government/enterprise organizations, nation-state or financially motivated actors are likely candidates for exploitation.

Report generated: 2025-01-15 | Classification: TLP:AMBER — Internal Distribution Only

This report is based solely on the data provided to the analyst. Specific technical claims beyond the NVD description are inferences from the vulnerability class and are clearly identified as such.