A critical arbitrary file read vulnerability in Weaver E-cology allows unauthenticated remote attackers to compromise sensitive system information and database credentials.

This vulnerability is a path traversal flaw (CWE-22) residing in the XmlRpcServlet interface. Unauthenticated remote attackers can trigger this by supplying malicious file paths to the WorkflowService.getAttachment and WorkflowService.LoadTemplateProp methods.

The ability for an unauthenticated attacker to read arbitrary files poses a severe risk to organizational confidentiality. Attackers can extract sensitive configuration files and database credentials, which often serve as a precursor to full system compromise or lateral movement within the network. With a CVSS score of 7.5, this vulnerability represents a high-severity risk that requires immediate attention to prevent unauthorized data exposure.

Immediate Action: Update the E-cology software to version 10.52 or later as provided by Weaver Network Co., Ltd.

Proactive Monitoring: Review web server access logs for anomalous requests directed at the XmlRpcServlet interface, specifically looking for attempts to access configuration or system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing path traversal sequences or unauthorized calls to the identified vulnerable XML-RPC methods.

Public Exploit Available: Yes, a published PoC exists, attributed to the technical write-ups referenced by the CVE record.

Given the confirmed history of active exploitation and the high risk associated with unauthorized file access, organizations must prioritize patching this vulnerability immediately. Failure to update to the recommended version leaves the underlying infrastructure exposed to credential theft and potential full system takeover by remote, unauthenticated actors.