53 lines
No EOL
2.2 KiB
Text
53 lines
No EOL
2.2 KiB
Text
Exploit Title: ZKTime Web Software 2.0 - Broken Authentication
|
||
CVE-ID: CVE-2017-14680
|
||
Vendor Homepage: https://www.zkteco.com/product/ZKTime_Web_2.0_435.html
|
||
Vendor of Product: ZKTeco
|
||
Affected Product Code: ZKTime Web - 2.0.1.12280
|
||
Category: WebApps
|
||
Author: Arvind V.
|
||
Author Social: @Find_Arvind
|
||
|
||
------------------------------------------
|
||
|
||
Product description:
|
||
ZKTime Web 2.0 is a cutting edge Web-based Time Attendance software, which
|
||
provided a stable communication for devices through GPRS/WAN, hence, users
|
||
can access the software anywhere by their Web Browser to remotely manage
|
||
hundreds of T&A terminals under complex network condition (WLAN). The
|
||
Application has an administrator role and application user role.
|
||
|
||
Attack Description:
|
||
The Application is a time attendance software which allows users to
|
||
download their time and attendance data from the application in a PDF
|
||
Format. The data includes their employee’s id, user-id, gender,
|
||
birth-dates, phone numbers and access-areas. These PDF Files however are
|
||
not properly authenticated. If any user get access to the file-download
|
||
link, he can go ahead and download these files directly without any
|
||
authentication.
|
||
|
||
Proof of Concept Links:
|
||
|
||
1) http://XX.XX.XX.XX:8081/tmp/report_file/Personnel_20170820144237.pdf
|
||
<http://xx.xx.xx.xx:8081/tmp/report_file/Personnel_20170820144237.pdf>
|
||
2) http://XX.XX.XX.XX:8081/tmp/report_file/Personnel_20170820144238.pdf
|
||
<http://xx.xx.xx.xx:8081/tmp/report_file/Personnel_20170820144238.pdf>
|
||
3) http://XX.XX.XX.XX:8081/tmp/report_file/Personnel_20170820144239.pdf
|
||
<http://xx.xx.xx.xx:8081/tmp/report_file/Personnel_20170820144239.pdf>
|
||
|
||
|
||
Impact:
|
||
Personal details pertaining to the employees of the company are disclosed
|
||
without their permissions. This leads to violation of user privacy.
|
||
Moreover the information available can be used to mount further attacks.
|
||
|
||
References:
|
||
http://seclists.org/fulldisclosure/2017/Sep/39
|
||
http://seclists.org/bugtraq/2017/Sep/20
|
||
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14680
|
||
|
||
|
||
Vulnerability Timeline:
|
||
18th August 2017 – Vulnerability Discovered
|
||
20th August 2017 – Contacted Vendor – No Response
|
||
1st September 2017 – Contacted Vendor again – No Response
|
||
18th September 2017 – Vulnerability Disclosed |