CVE-2024-48694
📋 TL;DR
This is a critical file upload vulnerability in OfficeWeb365 versions 8.6.1.0 and 7.18.23.0 that allows remote attackers to upload arbitrary files, leading to remote code execution. Attackers can exploit the pw/savedraw component without authentication to gain full control of affected systems. Organizations using these vulnerable versions are at immediate risk.
💻 Affected Systems
- Xi'an Daxi Information technology OfficeWeb365
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full administrative control, data exfiltration, ransomware deployment, and lateral movement within the network.
Likely Case
Remote code execution leading to web shell installation, data theft, and potential ransomware deployment on vulnerable systems.
If Mitigated
Attack blocked at perimeter with proper WAF/file upload filtering; limited to attempted exploitation logs.
🎯 Exploit Status
Multiple public PoCs exist; exploitation requires minimal technical skill due to available scripts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Check vendor website for updates and consider upgrading to latest version if available.
🔧 Temporary Workarounds
Block pw/savedraw endpoint
allRestrict access to the vulnerable component via web server configuration or firewall rules
# For Apache: RewriteRule ^/pw/savedraw.* - [F,L]
# For Nginx: location ~ ^/pw/savedraw { deny all; }
# For IIS: Add request filtering rule to block /pw/savedraw
Implement strict file upload filtering
allConfigure WAF or application firewall to block suspicious file uploads to the affected endpoint
# Example ModSecurity rule: SecRule REQUEST_URI "@contains /pw/savedraw" "id:1001,phase:1,deny"
🧯 If You Can't Patch
- Isolate affected systems from internet and restrict network access to necessary services only
- Implement strict file upload validation and monitoring on the pw/savedraw endpoint
🔍 How to Verify
Check if Vulnerable:
Check if OfficeWeb365 version is 8.6.1.0 or 7.18.23.0 and if /pw/savedraw endpoint is accessibleCheck Version:
Check web interface or configuration files for version informationVerify Fix Applied:
Test if file upload to /pw/savedraw endpoint is blocked or properly validated📡 Detection & Monitoring
Log Indicators:
- POST requests to /pw/savedraw with file uploads
- Unusual file creation in web directories
- Execution of suspicious scripts from web-accessible locations
Network Indicators:
- HTTP POST requests to /pw/savedraw with executable file extensions
- Outbound connections from web server to suspicious IPs
SIEM Query:
source="web_logs" AND uri="/pw/savedraw" AND (method="POST" OR file_extension IN ("php", "asp", "aspx", "jsp", "war"))🔗 References
- https://avd.aliyun.com/detail?id=AVD-2023-1678930
- https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/32024c5dbb7ff60fa7347cccf6ebb3763a513e7a/docs/wiki/webapp/OfficeWeb365/OfficeWeb365%20SaveDraw%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md?plain=1#L24
- https://github.com/Threekiii/Vulnerability-Wiki/blob/master/docs-base/docs/webapp/OfficeWeb365-SaveDraw-%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.md
- https://github.com/luck-ying/Library-POC/blob/master/2023HW/2023.8.15/OfficeWeb365_SaveDraw%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E.py
- https://github.com/xuetang1125/OfficeWeb365/blob/main/OfficeWeb365%20SaveDraw%20%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0%E6%BC%8F%E6%B4%9E%20%282%29.md
