CVE-2022-36537 PoC — ZK 安全漏洞

Source

https://github.com/Malwareman007/CVE-2022-36537

Associated Vulnerability

Title:ZK 安全漏洞 (CVE-2022-36537)
Description:ZK是ZK公司的一个高产的开源Java框架，用于构建惊人的企业网和移动应用程序。 ZK Framework v9.6.1版本、9.6.0.1版本、9.5.1.3版本、9.0.1.2版本、8.6.4.1版本存在安全漏洞。攻击者利用该漏洞通过发送 AuUploader 组件的特制 POST 请求访问敏感信息。

Description

POC of CVE-2022-36537

Readme

# CVE-2022-36537

# Summary

R1Soft Server Backup Manager uses the ZK framework as the main framework. Its security requires all Web3 project parties to pay more attention to the security vulnerabilities of various Web3 infrastructures and patch them in time to avoid potential security risks and digital asset losses. We will dig out in time, track various security risks on web3, and provide leading security solutions to ensure that the web3 world chain and off-chain are safe and sound.

# Preface

ZK is the leading open-source Java Web framework for building enterprise Web applications. With over 2,000,000 downloads, ZK empowers a wide variety of companies and institutions, ranging from small to Fortune Global 500 in multiple industries.

R1Soft Server Backup Manager (SBM) offers service providers a flexible, server-friendly solution that takes the hassle out of running traditional backups. Users can run backups every 15 minutes without impacting server performance. Nearly 1,800 service providers use it to protect 250,000 servers.

# Affected Versions

ZK Framework `v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1.`

ConnectWise Recover `v2.9.7` and earlier versions are impacted.

R1Soft Server Backup Manager `v6.16.3` and earlier versions are impacted.

# ZK Framework Auth Bypass
![unnamed](https://user-images.githubusercontent.com/86009160/206724396-7e7ae1b6-e653-4a57-b0c2-f11917f502c8.png)
![ZK-5150](https://user-images.githubusercontent.com/86009160/206724526-3d4d4947-f92d-4dff-b2f6-ba763c37fa0a.png)


From the vulnerability description, if the route /zkau/upload contains the nextURI parameter, the ZK AuUploader servlet will forward the forward request, which can bypass the identity authentication and return the files in the web context, such as obtaining web.xml, zk page, applicationContext -security.xml configuration information, etc.

# Install

`You need python3, pip3, git.`
```
git clone https://github.com/Malwareman007/CVE-2022-36537-EXPLOIT.git
cd CVE-2022-36537-EXPLOIT
pip3 install -r requirements.txt
python3 CVE-2022-36537.py
```

# Shodan Dork 

![Shodan Dork](https://user-images.githubusercontent.com/86009160/206724741-3c6c6abf-544d-4121-9eb5-f92eee16aa7c.jpg)


# CVE-2022–36537 Vulnerability More Details 


https://user-images.githubusercontent.com/86009160/206725395-9a42b6e9-5739-4119-b337-e95408a4e5f6.mp4



# Special Thanks TO

 Bearcat

File Snapshot


 [4.0K]  /data/pocs/6a013051c747a4b2f878e54918852f00e63078fc
├── [ 16M]  chromedriver
├── [7.9K]  CVE-2022-36537.py
├── [1.4K]  Driver.java
├── [ 34K]  LICENSE
├── [983K]  mysql-connector-java-5.1.48.jar
├── [2.3K]  README.md
└── [  88]  requirements.txt

0 directories, 7 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!