Associated Vulnerability
Title:ZK 安全漏洞 (CVE-2022-36537)Description:ZK Framework v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 allows attackers to access sensitive information via a crafted POST request sent to the component AuUploader.
Readme
# CVE-2022-36537
# Summary
R1Soft Server Backup Manager uses the ZK framework as the main framework. Its security requires all Web3 project parties to pay more attention to the security vulnerabilities of various Web3 infrastructures and patch them in time to avoid potential security risks and digital asset losses. We will dig out in time, track various security risks on web3, and provide leading security solutions to ensure that the web3 world chain and off-chain are safe and sound.
# Preface
ZK is the leading open-source Java Web framework for building enterprise Web applications. With over 2,000,000 downloads, ZK empowers a wide variety of companies and institutions, ranging from small to Fortune Global 500 in multiple industries.
R1Soft Server Backup Manager (SBM) offers service providers a flexible, server-friendly solution that takes the hassle out of running traditional backups. Users can run backups every 15 minutes without impacting server performance. Nearly 1,800 service providers use it to protect 250,000 servers.
# Affected Versions
ZK Framework `v9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1.`
ConnectWise Recover `v2.9.7` and earlier versions are impacted.
R1Soft Server Backup Manager `v6.16.3` and earlier versions are impacted.
# ZK Framework Auth Bypass
From the vulnerability description, if the route /zkau/upload contains the nextURI parameter, the ZK AuUploader servlet will forward the forward request, which can bypass the identity authentication and return the files in the web context, such as obtaining web.xml, zk page, applicationContext -security.xml configuration information, etc.
# Install
`You need python3, pip3, git.`
```
git clone https://github.com/Malwareman007/CVE-2022-36537-EXPLOIT.git
cd CVE-2022-36537-EXPLOIT
pip3 install -r requirements.txt
python3 CVE-2022-36537.py
```
# Shodan Dork
# CVE-2022–36537 Vulnerability More Details
https://user-images.githubusercontent.com/86009160/206725395-9a42b6e9-5739-4119-b337-e95408a4e5f6.mp4
# Special Thanks TO
Bearcat
File Snapshot
[4.0K] /data/pocs/ee6fe61ace8598ae95135f748c36d59aae6b08a8
├── [ 16M] chromedriver
├── [7.9K] CVE-2022-36537.py
├── [1.4K] Driver.java
├── [ 34K] LICENSE
├── [983K] mysql-connector-java-5.1.48.jar
├── [2.3K] README.md
└── [ 88] requirements.txt
1 directory, 7 files
Remarks
1. It is advised to access via the original source first.
2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.
3. Mirroring, verifying, and maintaining this POC archive takes ongoing effort, so local snapshots are a paid feature. Your subscription keeps the archive online — thank you for the support. View subscription plans →