Weaver e-Bridge: Unauthenticated arbitrary file read and SSRF via saveYZJFile
Summary
Weaver e-Bridge, an integration middleware, exposes the saveYZJFile endpoint without authentication. By supplying a file: URL or an http(s) URL in the downloadUrl parameter, a remote attacker can read arbitrary files on the host, such as /etc/passwd or configuration and credential files, and reach internal network resources through server-side request forgery. No user interaction or credentials are required. Exploitation was first observed by the Shadowserver Foundation on 2023-10-17.
Affected
- Weaver e-Bridge, all versions (unconfirmed; no specific versions listed in the CVE record)
- Vendor-confirmed affected versions: Unknown.
Fixed in
- Unknown. No vendor fix has been confirmed for this CVE.
Workaround
- No confirmed vendor workaround.
- Third-party advice (Vuldb): block requests with file: schemes or suspicious URLs targeting internal IP ranges, e.g. with a Web Application Firewall.
- Restrict access to e-Bridge to required sources only.
- Limit outbound connections from the e-Bridge host to internal services and the local filesystem.
Exploitation
- Exploitation in the wild observed by Shadowserver since 2023-10-17.
- Public proof-of-concept available: a nuclei template and a Goby module.
- CISA KEV status not verified.
- EPSS score is low.
Our recommendation
- Identify all e-Bridge instances and check whether they are reachable from the internet.
- Contact Weaver or your local partner to confirm affected and fixed versions and apply any vendor patch.
- Apply the network-level mitigations above until a fix is confirmed.
- Restrict outbound connections from the e-Bridge host.
- Review web logs for requests to the saveYZJFile path containing file: or internal URLs, and check for signs of data access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory www.vulncheck.com
- Nuclei template weaver-ebridge-lfi github.com
- Weaver e-Bridge changelog www.weaver.com.cn
- Vuldb CVE-2020-37278 vuldb.com
- OpenCVE CVE-2020-37278 app.opencve.io
- Strix CVE-2020-37278 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 05:45.
Original description (NVD)
Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arbitrary files on the host system by supplying a file: URL to the downloadUrl parameter of the saveYZJFile endpoint. Attackers can exploit this flaw to read sensitive files such as /etc/passwd or configuration and credential files, and the same endpoint's support for http(s) URLs also enables server-side request forgery against internal network resources. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.