Paper/Archive/CVE-2023-38951

CVE-2023-38951

mitre — ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on t…

EPSS 3%public exploit CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 88.4.884 × 2017.7 Exploit: SSVC poc+1010.0 SSVC exploitation: poc+100.0

Description · from the CVE record

ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH Key field. Overwriting specific files may lead to arbitrary code execution as NT AUTHORITY\SYSTEM.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refclaroty.com/team82/disclosure-dashboard/cve-2023-38951 refgithub.com/omair2084/biotime-rce-8.5.5/blob/main/biotime_enum.py refkrashconsulting.com/fury-of-fingers-biotime-rce refzkteco.com/en/ZKBio_Time/ZKBioTime#Download refzkteco.com/en/announcement exploitsploitus.com/exploit?id=PACKETSTORM:177859