BaseFortify

Executive Summary

CVE-2023-38950 is a path traversal vulnerability in the iclock API of ZKTeco BioTime version 8.5.5. It allows unauthenticated attackers to read arbitrary files on the affected system by supplying a crafted payload. This vulnerability enables attackers to access sensitive files such as configuration files, which may contain encrypted passwords. Additionally, the exploit can lead to remote code execution by manipulating SFTP settings to execute system commands, allowing full system compromise. [2, 5, 4]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting directory traversal attacks against the /iclock/file endpoint of the ZKTeco BioTime system. Specifically, crafted URL parameters can be used to try to access sensitive files such as windows/win.ini or BioTime configuration files (attsite.ini). Additionally, reconnaissance can be performed by accessing the /license/ and /login/ endpoints to identify the BioTime version and obtain CSRF tokens and session cookies. Commands or actions include sending crafted HTTP requests to the /iclock/file endpoint with traversal payloads, and checking for responses containing base64 encoded configuration files or decrypted passwords. Exploit scripts publicly available (e.g., from the exploit details) automate these checks by performing directory traversal, decrypting configuration files, and attempting brute-force login with default credentials (usernames 1-9 with password '123456'). [5]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access to sensitive files and configuration data, exposure of encrypted credentials, and potentially full remote code execution on the affected system. Attackers can add new users with administrative privileges, download sensitive backups, and execute arbitrary system commands, leading to complete system compromise and loss of data confidentiality and integrity. [5, 2, 4]

Useful 0 Not Useful 0