CVE-2023-2766

Executive Summary

CVE-2023-2766 is a problematic information disclosure vulnerability affecting Weaver OA version 9.5. The flaw resides in the file /building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini, which is accessible without authentication. An attacker can remotely retrieve this configuration file, which contains database credentials (sdbuser and sdbpassword). The vulnerability has a CVSS v3.1 base score of 7.5 (High) and is classified under CWE-552 (Files or Directories Accessible to External Parties). Public proof-of-concept (PoC) code and a Nuclei template are available, increasing the risk of exploitation. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone web application vulnerability in Weaver OA.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is High due to the low attack complexity, no required privileges, and the high confidentiality impact (exposure of database credentials).

Deep Dive & Mechanics

The vulnerability is a classic case of insecure direct object reference (IDOR) combined with a lack of access control. The file jx2_config.ini is stored in a publicly accessible web directory (/building/backmgr/urlpage/mobileurl/configfile/). The web server does not enforce authentication or authorization checks for this path. When an attacker sends a GET request to this URL, the server returns the contents of the configuration file, which includes plaintext database credentials.

The root cause is the absence of proper access controls on the /building/backmgr/ directory tree. The application likely relies on the assumption that only authenticated users would know or navigate to these paths, but no server-side verification is performed.

Vulnerable vs. Patched Code

Vulnerable Code (Weaver OA 9.5): The file jx2_config.ini is stored in a web-accessible directory without any access control. Example content:

sdbuser = weaver_db_user
sdbpassword = weaver_db_password

Patched Code: No official patch is available. A hypothetical fix would involve:

1. Moving the configuration file outside the web root.
2. Implementing authentication checks for the /building/backmgr/ directory.
3. Encrypting sensitive data in configuration files.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Weaver OA 9.5 in a controlled environment (e.g., Docker or VM).
2. Ensure the application is running and the vulnerable endpoint is accessible.

Exploitation Steps:

1. Use curl or a browser to request the configuration file:

   curl http://target/building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini
   

2. The response will contain the database credentials in plaintext.

Automated Exploitation (Nuclei): Use the provided Nuclei template (see Detection Engineering section) to scan for the vulnerability.

Blue Team

Detection:

• Monitor web server logs for requests to /building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini.
• Alert on any successful HTTP 200 responses for this path.

Mitigation:

• Immediately restrict access to the /building/backmgr/ directory using web server rules (e.g., .htaccess or Nginx deny all).
• If possible, move the configuration file outside the web root.
• Implement network segmentation to limit exposure.

Indicators of Compromise (IOCs)

• URL Pattern: /building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini
• HTTP Response: Status code 200 with Content-Type: text/plain and body containing sdbuser = and sdbpassword =.
• Source IPs: Any IP making repeated requests to the vulnerable path.
• User-Agent: Common scanning tools (e.g., Nuclei, curl, Python requests).

Detection Engineering

YARA Rule

rule CVE_2023_2766_Weaver_OA_Info_Disclosure {
    meta:
        description = "Detects requests to Weaver OA 9.5 vulnerable config file"
        author = "Valters IT"
        date = "2025-04-08"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-2766"
    strings:
        $sdbuser = "sdbuser ="
        $sdbpassword = "sdbpassword ="
        $path = "/building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini"
    condition:
        any of ($sdbuser, $sdbpassword) and $path
}

Sigma Rule

title: CVE-2023-2766 Weaver OA Config File Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to the vulnerable Weaver OA configuration file
author: Valters IT
date: 2025/04/08
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-stem: "/building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini"
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate administrative access (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-2766 Weaver OA Config File Access"; flow:to_server; content:"GET"; http_method; content:"/building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-2766

info:
  name: Weaver OA 9.5 - Information Disclosure
  author: DhiyaneshDK
  severity: high
  description: |
    A vulnerability was found in Weaver OA 9.5 and classified as problematic. This issue affects some unknown processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini. The manipulation leads to files or directories accessible. The attack may be initiated remotely.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    An attacker can exploit this vulnerability to gain unauthorized access to sensitive information.
  reference:
    - https://github.com/8079048q/cve/blob/main/weaveroa.md
    - https://nvd.nist.gov/vuln/detail/CVE-2023-2766
    - https://vuldb.com/?ctiid.229271
    - https://vuldb.com/?id.229271
    - https://github.com/Vme18000yuan/FreePOC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-2766
    cwe-id: CWE-552
    epss-score: 0.91816
    epss-percentile: 0.99694
    cpe: cpe:2.3:a:weaver:weaver_office_automation:9.5:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: weaver
    product: weaver_office_automation
    fofa-query:
      - app="泛微-EOffice"
      - app="泛微-eoffice"
  tags: cve,cve2023,weaver,eoffice,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/building/backmgr/urlpage/mobileurl/configfile/jx2_config.ini"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header,"text/plain")'
          - 'contains_all(body, "sdbuser =","sdbpassword =")'
        condition: and
# digest: 4b0a004830460221008239ca2ff0fdf54cdf6ea9cde7080b6762f1f0e8057093e7015754ad9be56d8c022100a14f23c1ad3dd4c1991e6d820977dfc775d59b7bd54517e83206f3d5f1d5d085:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Add the following rule to your web server configuration to deny access to the /building/backmgr/ directory:
   • Apache: <Directory "/path/to/building/backmgr/"> Require all denied </Directory>
   • Nginx: location /building/backmgr/ { deny all; }
2. Move Configuration Files: Relocate jx2_config.ini and similar files outside the web root.
3. Change Credentials: Immediately rotate any database credentials exposed by this vulnerability.

Long-Term Fixes:

• Implement proper authentication and authorization for all administrative endpoints.
• Conduct a security audit of the entire Weaver OA installation.
• Monitor vendor channels for an official patch.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Division. For questions, contact cti@valters.it.

{/* [Security Hash: 613D7EDCC169BF37242E1CF9] */}