CISA Issues Warning on Active Exploitation of ZK Java Web Framework Vulnerability
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-36537 | Unauthenticated Information Disclosure in ZK Framework AuUploader ZK Framework versions 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2 and 8.6.4.1 fail to properly handle requests to the AuUploader servlet component, allowing unauthenticated attackers to access sensitive information. The flaw is triggered by sending a crafted POST request to the AuUploader endpoint over the network; no privileges or user interaction are required, and per the CVSS vector the impact is limited to confidentiality (no tampering or denial of service). An attacker gains the ability to read sensitive data served by Java web applications built on the affected ZK releases, potentially yielding details that enable follow-on intrusions. Any organization running or hosting a web application that embeds one of the affected ZK Framework versions is exposed, including third-party products that bundle the framework. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2023-02-27 with known ransomware use and required federal agencies to apply vendor updates, and its top-percentile EPSS score of 95.3% indicates a very high likelihood of continued exploitation. Do: Upgrade ZK Framework to a patched release per vendor instructions, replacing the affected builds (8.6.4.1, 9.0.1.2, 9.5.1.3, 9.6.0.1 and 9.6.1). Inventory web applications and bundled products that use ZK, determine whether the AuUploader servlet is reachable, and restrict or filter access to that endpoint at the application server, reverse proxy, or WAF as an interim mitigation. Given the known ransomware-linked exploitation, prioritize patching internet-facing applications first. | 7.5 | 95% | KEV ransomware |
| large≈ tens of thousands of internet-exposed Java web applications embedding ZK (estimate) |
Full article292 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananFeb 28, 2023Software Security / Cyber Attack
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity flaw affecting the ZK Framework to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation.
Tracked as CVE-2022-36537 (CVSS score: 7.5), the issue impacts ZK Framework versions 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2, and 8.6.4.1, and allows threat actors to retrieve sensitive information via specially crafted requests.
"The ZK Framework is an open source Java framework," CISA said. "This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager."
The vulnerability was patched in May 2022 in versions 9.6.2, 9.6.0.2, 9.5.1.4, 9.0.1.3, and 8.6.4.2.
As demonstrated by Huntress in a proof-of-concept (PoC) in October 2022, the vulnerability can be weaponized to bypass authentication, upload a backdoored JDBC database driver to gain code execution, and deploy ransomware on susceptible endpoints.
Singapore-based Numen Cyber Labs, in addition to publishing a PoC of its own in December 2022, cautioned that it found more than 4,000 Server Backup Manager instances exposed on the internet.
The vulnerability has since come under mass exploitation, as evidenced by NCC Group's Fox-IT research team last week, to obtain initial access and deploy a web shell backdoor on 286 servers.
A majority of the infections are located in the U.S., South Korea, the U.K., Canada, Spain, Colombia, Malaysia, Italy, India, and Panama. A total of 146 R1Soft servers remain backdoored as of February 20, 2023.
"Over the course of the compromise, the adversary was able to exfiltrate VPN configuration files, IT administration information, and other sensitive documents," Fox-IT said.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/02/cisa-issues-warning-on-active.html