QID 150657

Date Published: 2023-03-15

QID 150657: ZK Framework - Authentication Bypass Vulnerability (CVE-2022-36537)

ZK is an open-source Ajax Web application framework, written in Java, that enables creation of graphical user interfaces for Web applications.

Affected versions of ZK Framework allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.

ZK AuUploader servlets contains a security vulnerability which can be exploited to retrieve the content of a file located in the web context. This includes files normally hidden from the user located in WEB-INF, such as web.xml, zk.xml, etc.

Affected Versions:
ZK Framework prior to version 8.6.4.1
ZK Framework from 9.0.0 before version 9.0.1.3
ZK Framework from 9.5.0 before version 9.5.1.3
ZK Framework from 9.6.0 before version 9.6.2

QID Detection Logic: (Unauthenticated)
This QID sends a specially crafted HTTP POST request to "/zkau/upload" endpoint and retrieves web.xml or zk.xml internal files and based on response confirms the vulnerability.

Successful exploitation could allow a remote attacker to read sensitive files located in restricted WEB-INF folder, which exposes internal files such as web.xml, zk.xml and other files located in this directory.

CVSS V3 rated as High - 7.5 severity.

CVSS V2 rated as High - 7.8 severity.

Solution

Customers are advised to upgrade ZK Framework to version 9.6.2, 9.6.0.2, 9.5.1.4, 9.0.1.3, 8.6.4.2 or latest version to remediate this vulnerability. For more information pertaining to this vulnerability please refer ZK-5150.

Vendor References

ZK-5150 - tracker.zkoss.org/browse/ZK-5150

CVEs related to QID 150657

CVE-2022-36537 |

Software Advisories

Advisory ID	Software	Component	Link
ZK-5150			tracker.zkoss.org/browse/ZK-5150

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].