CVE-2022-4995: Unauthenticated File Upload in Weaver E-cology
TL;DR - CVE-2022-4995 is a critical unauthenticated file upload flaw in Weaver E-cology. - E-cology versions prior to 10.52 are affected; upgrade and restrict the vulnerable JSP endpoint. - NVD reports exploitation evidence observed in the wild, so internet-facing systems should be treated as urgent.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2022-4995 |
| CVSS v3.1 | 9.8 Critical |
| Attack vector | Network |
| Auth required | None |
| Patch available | Yes, fixed in 10.52 |
CVE-2022-4995 is a high-priority remote attack surface issue because the vulnerable endpoint is reachable over HTTP and does not require authentication. Attackers can upload arbitrary files, including JSP webshells, achieving remote code execution in the context of the application server process. For more details on a related vulnerability, check out CVE-2026-21548.
What Is This Vulnerability?
CVE-2022-4995 is an unauthenticated arbitrary file upload vulnerability in Weaver E-cology. An attacker can send a crafted multipart/form-data POST request to /workrelate/plan/util/uploaderOperate.jsp and provide arbitrary values for secId and plandetailid. The application accepts the uploaded file without adequate authentication and validation, making it possible to upload attacker-controlled content.
The security impact becomes critical because arbitrary uploaded content can include server-executable JSP files. In a Java web application environment, this means a malicious upload can become a webshell or launcher for command execution. NVD states that successful exploitation results in remote code execution under the privileges of the application server process.
Technical Notes
Example request structure:
POST /workrelate/plan/util/uploaderOperate.jsp HTTP/1.1
Host: target.example
Content-Type: multipart/form-data; boundary=----boundary
------boundary
Content-Disposition: form-data; name="secId"
1
------boundary
Content-Disposition: form-data; name="Filedata"; filename="hello.jsp"
Content-Type: application/octet-stream
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<% out.print("Hello World!"); %>
------boundary
Content-Disposition: form-data; name="plandetailid"
1
------boundary--
Who Is Affected?
The affected product identified in NVD is Weaver (Fanwei) E-cology 9.0. The affected range is stated as versions prior to 10.52. If you operate E-cology and do not have a reliable inventory of exact application versions, the safest assumption is that any instance labeled E-cology 9.0 requires verification against the 10.52 fixed level.
Organizations most at risk are those that expose E-cology directly to the internet and those that allow broad inbound access from untrusted networks. Because exploitation is unauthenticated, perimeter reachability matters more than account hygiene.
Technical Notes
Useful validation steps for asset owners:
# Search reverse proxy or web server configs for E-cology paths
grep -R "uploaderOperate.jsp\|OfficeServer\|ecology" /etc/nginx /etc/httpd /usr/local/nginx/conf 2>/dev/null
CVSS Score Breakdown
The published CVSS v3.1 base score is 9.8 Critical. This score aligns with a network-reachable, unauthenticated vulnerability with high impact on confidentiality, integrity, and availability. An attacker can exploit the issue remotely without prior access, achieving meaningful control over the application host.
Exploitation Status
Public exploit information exists, and NVD references a GitHub resource containing PoC-style material. More importantly, exploitation in the wild has been observed. This issue has crossed the line from exploitable to observed in operational environments.
Technical Notes
Practical assumptions defenders should make:
PoC public? Yes, public exploit information is referenced by NVD and technical write-ups.
Active exploitation confirmed? Yes, NVD states exploitation evidence was observed by Shadowserver.
How to Detect It
Detection should focus on three areas: access to the vulnerable endpoint, suspicious multipart uploads containing JSP or unexpected file types, and post-upload access patterns that suggest webshell activation. The primary HTTP indicator is a POST request to /workrelate/plan/util/uploaderOperate.jsp.
Technical Notes
Example web log patterns to hunt:
POST /workrelate/plan/util/uploaderOperate.jsp HTTP/1.1
Content-Type: multipart/form-data; boundary=...
Mitigation and Patching
The primary remediation is to upgrade Weaver E-cology to version 10.52 or later. Use Weaver’s official security patch and changelog resources to obtain the vendor-approved update package. If you cannot patch immediately, reduce exposure by blocking or strictly limiting access to /workrelate/plan/util/uploaderOperate.jsp.
Technical Notes
Example NGINX temporary block rule:
location = /workrelate/plan/util/uploaderOperate.jsp {
deny all;
return 403;
}
References
The NVD entry is the authoritative source for the CVE summary, affected range, fixed version statement, severity, and the note that exploitation evidence was observed by the Shadowserver Foundation. For further reading, you can check CVE-2026-32999 for additional context on vulnerabilities in similar systems.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.