Unauthenticated Arbitrary File Upload in Weaver E-office

Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary filenames and disguised content types. Attackers can upload PHP webshells to the Document directory and execute them via HTTP GET requests to achieve remote code execution as the web server user. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-10-10 (UTC).

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2022-50993 represents a critical unauthenticated arbitrary file upload vulnerability affecting Weaver (Fanwei) E-office versions before 10.0_20221201. The OfficeServer.php endpoint fails to properly validate file uploads, allowing attackers to bypass authentication entirely and upload malicious files—particularly PHP webshells—by manipulating multipart POST requests with arbitrary filenames and spoofed content types. Once uploaded to the Document directory, these files become executable via HTTP GET requests, granting attackers remote code execution with web server privileges. This vulnerability is especially dangerous because it requires no authentication, no user interaction, and provides immediate code execution capabilities, making it a direct pathway to full system compromise for any organization running vulnerable versions of this widely-used enterprise office platform.

Casky's 419 mapped skills across MITRE ATT&CK techniques enable practitioners to detect the attack chain behind this exploitation. The platform's Claude AI-powered analysis identifies Initial Access (TA0001) patterns—specifically the unauthenticated POST requests to suspicious endpoints—alongside Execution (TA0002) indicators like unexpected PHP file creation and execution in web directories. Persistence (TA0043) detection surfaces the webshell artifacts remaining in Document folders post-exploitation. When a practitioner runs Casky's extended reasoning against network logs or file system events, they'll receive findings highlighting: suspicious multipart/form-data requests to /OfficeServer.php, newly created .php files in web-accessible directories with non-standard content type headers, and subsequent GET requests executing those files. This multi-technique correlation dramatically reduces false positives and helps security teams prioritize response efforts toward genuine exploitation attempts versus legitimate administrative uploads.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2022-50993.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2022-50993

Casky has 419 skills that investigate the attack patterns behind CVE-2022-50993. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn