Unauthenticated Arbitrary File Upload RCE in Weaver E-office OfficeServer.php

Successful exploitation allows an unauthenticated remote attacker to upload and execute arbitrary PHP code on the target server. This yields remote code execution as the web server user, enabling full compromise of the affected web application, deployment of webshells, theft or modification of application data, use of the host as a pivot point for further intrusion, and potential broader server compromise depending on the privileges and environment of the web server account.

If immediate patching is not possible, restrict or disable external access to the vulnerable OfficeServer.php endpoint, especially from untrusted networks. Block multipart upload requests to the endpoint where operationally feasible, and place the application behind access controls, VPN, or IP allowlisting. Configure the web server so upload directories are non-executable, and deny execution of PHP or other server-side scripts from the Document directory and other writable paths. Monitor for suspicious file uploads, newly created PHP files in web-accessible directories, and subsequent HTTP GET requests to uploaded content. Web application firewall rules targeting arbitrary file upload patterns may reduce exposure but are not a substitute for remediation.

Upgrade Weaver (Fanwei) E-office to version 10.0_20221201 or later, as versions prior to 10.0_20221201 are described as vulnerable. Review the OfficeServer.php upload handling logic to ensure strict server-side validation of file type, filename, extension, storage path, and execution permissions. Prevent uploaded files from being written to web-accessible executable locations such as the Document directory, and ensure executable script types such as PHP cannot be uploaded or executed from upload directories. Conduct incident response review for signs of prior exploitation, including unexpected files in upload paths and webshell activity.