Arbitrary File Read and SSRF Vulnerability in Weaver e-Bridge

Weaver e-Bridge contains a critical vulnerability (CVE-2020-37278) within its saveYZJFile endpoint that allows for both unauthenticated arbitrary file read and server-side request forgery (SSRF). By manipulating the downloadUrl parameter, a remote attacker can force the application to retrieve and expose local files, such as /etc/passwd, or leverage the server as a proxy to conduct SSRF attacks against internal network infrastructure. This vulnerability represents a significant risk for environments utilizing e-Bridge, as it facilitates credential theft, configuration leakage, and internal reconnaissance. Exploitation of this flaw has been observed in the wild since October 17, 2023, as documented by the Shadowserver Foundation. Defenders should prioritize patching and monitoring traffic directed toward the affected endpoint.

Attack Chain

1. Attacker identifies an internet-facing instance of Weaver e-Bridge.
2. Attacker crafts an HTTP request targeting the saveYZJFile endpoint.
3. Attacker injects a file:// URI into the downloadUrl parameter to target local files (e.g., /etc/passwd).
4. The application processes the malicious parameter without sufficient input validation.
5. The server reads the content of the specified local file from the disk.
6. The server returns the contents of the file in the HTTP response body to the attacker.
7. Alternatively, the attacker injects an http(s):// URI into the downloadUrl parameter to probe internal services.
8. The server performs the request as the internal host, allowing the attacker to bypass network perimeter controls.

Impact

Successful exploitation allows unauthenticated remote attackers to read arbitrary files from the host filesystem, potentially leading to full system compromise through the exposure of configuration files, keys, and credentials. Furthermore, the SSRF capability enables attackers to pivot into the internal network, perform port scanning, and interact with internal-only web services that are otherwise unreachable from the internet.

Recommendation

• Monitor web server access logs for anomalous requests to the saveYZJFile endpoint involving file:// or unexpected URL schemes in the downloadUrl parameter.
• Deploy the provided Sigma rule to detect exploitation attempts against the vulnerable endpoint.
• Patch affected Weaver e-Bridge instances immediately as updates become available from the vendor.
• Restrict network access to the saveYZJFile endpoint at the firewall level if immediate patching is not possible.