PT-2022-24575 · Zkteco · Zkteco Biotime

Ahmed Kameran · Published 2022-11-30 · Updated 2023-09-13 · CVE-2022-38802

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zkteco BioTime versions prior to 8.5.3 Build:20200816.447

Description The issue is related to Incorrect Access Control, allowing an authenticated administrator to exploit XSS in a pdf generator when exporting data as a PDF, potentially enabling them to read local files. This can be achieved via various features such as resign, private message, manual log, time interval, attshift, and holiday.

Recommendations For Zkteco BioTime versions prior to 8.5.3 Build:20200816.447, update to version 8.5.3 Build:20200816.447 or later to resolve the issue. As a temporary workaround, consider restricting access to the pdf generator and limiting the ability to export data as a PDF to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-38802

Affected Products

Zkteco Biotime

References · 6

• 🔥 https://gist.github.com/hamoshwani/fd7e3d9d9ff8896f1ccf8426dccaf97e · Exploit
• https://osv.dev/vulnerability/CVE-2022-38802 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38802 · Security Note
• https://twitter.com/hamoshwani/status/1701867480577089916 · Twitter Post
• https://zkteco.com · Note
• https://t.me/cibsecurity/53721 · Telegram Post