Introduction
An exposed debugging endpoint in Weaver's E-cology 10.0 platform lets unauthenticated attackers run arbitrary system commands on the server. The Shadowserver Foundation has confirmed active exploitation in the wild since late March 2026. With a CVSS 3.1 score of 9.8 and trivial exploitation requirements, this is a serious risk to any organization running an unpatched instance.
Weaver Network Technology Co., Ltd. is a publicly traded Chinese technology corporation (Shanghai Stock Exchange, Stock Code 603039), founded in 2001 and headquartered in Shanghai. The company builds collaborative management and Office Automation platforms. Its flagship E-cology product is widely deployed across enterprises in the Asia Pacific region, including Singapore, Malaysia, Indonesia, Thailand, Vietnam, and Australia. E-cology instances often hold sensitive organizational data and sit inside internal network perimeters, which makes them high-value targets.
Technical Information
Root Cause: Missing Authentication on a Debug Endpoint
The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). The /papi/esearch/data/devops/dubboApi/debug/method endpoint in E-cology 10.0 was built for internal debugging of Dubbo service interfaces, but it shipped to production with no authentication or authorization controls. Any attacker who can reach it over the network can interact with it directly. No credentials, session tokens, or prior application interaction are required.
How the Endpoint Works
The endpoint accepts HTTP POST requests with a JSON body. Two parameters matter:
interfaceName: the fully qualified Java class name to invoke.methodName: the method on that class to call.
Both are entirely attacker-controlled. The application uses these values to dynamically resolve and invoke the specified Java class and method on the server side. The command payload is passed through a JSON array in the request body.
Known Exploitation Paths
Security researchers have identified at least two class/method combinations that lead directly to arbitrary command execution:
Target Class (interfaceName) | Target Method (methodName) | Description |
|---|---|---|
com.weaver.dw.platform.spark.util.LinuxCommand | execCmdWaitStdOut | A Weaver internal utility that runs Linux commands and returns stdout |
cn.hutool.core.util.RuntimeUtil | execForStr | A Hutool library method wrapping Runtime.exec() that returns output as a string |
Attack Flow
- Reconnaissance: the attacker finds an internet-facing E-cology 10 instance, for example through Shodan, Censys, or targeted scanning.
- Crafting the Request: the attacker builds an HTTP POST request to
/papi/esearch/data/devops/dubboApi/debug/methodwith a JSON body that specifies one of the knowninterfaceName/methodNamepairs and the desired system command in a JSON array. - Execution: the server resolves the specified class and method and runs the attacker-supplied command on the host operating system.
- Response: a successful attempt typically returns an HTTP 200 status code. The response body contains indicators such as
"code":500and"msg":"系统错误"(System Error), which paradoxically confirm that the command execution helper was reached and invoked.
The whole attack takes a single HTTP request and no authentication, which makes it well suited to automated scanning and mass exploitation.
Affected Systems and Versions
- Product: Weaver (Fanwei) E-cology 10.0
- Affected Versions: all E-cology 10.0 versions prior to security patch v20260312
- Fixed Version: security patch v20260312 (released 2026-03-12)
- Vulnerable Endpoint:
/papi/esearch/data/devops/dubboApi/debug/method
Any E-cology 10.0 deployment that has not applied the v20260312 patch and is reachable over the network, especially internet-facing instances, should be treated as vulnerable.
Vendor Security History
Weaver's platforms have been the subject of earlier security disclosures. In late 2024, CVE-2024-48072, a SQL injection vulnerability in Weaver Ecology v9, was disclosed and cataloged by national cybersecurity agencies including CISA. Recurring critical vulnerabilities in Weaver products are a reason to stay current on patches and to segment the network around these platforms.
References
- VulnCheck Advisory: Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint
- QAX CERT Vulnerability Notice
- Weaver Security Download Center
- Weaver Security Update Notification (v20260312)
- Technical Analysis and PoC Details (h4cker.zip)
- Independent Vulnerability Analysis (gm7.org)
- CVE-2024-48072 Detail (NVD)
- CISA Vulnerability Summary, Week of November 18, 2024
