ZKTeco ZKBioSecurity 3.0 (visLogin.jsp) Local Authorization Bypass
Title: ZKTeco ZKBioSecurity 3.0 (visLogin.jsp) Local Authorization Bypass
Advisory ID: ZSL-2016-5367
Type: Local/Remote
Impact: Security Bypass
Risk: (2/5)
Release Date: 31.08.2016
Platform: 3.0.1.0_R_230
Personnel: 1.0.1.0_R_1916
Access: 6.0.1.0_R_1757
Elevator: 2.0.1.0_R_777
Visitor: 2.0.1.0_R_877
Video:2.0.1.0_R_489
Adms: 1.0.1.0_R_197
Microsoft Windows 7 Professional SP1 (EN)
Apache-Coyote/1.1
Apache Tomcat/7.0.56
[27.07.2016] Vendor contacted.
[29.08.2016] No response from the vendor.
[31.08.2016] Public security advisory released.
[2] https://exchange.xforce.ibmcloud.com/vulnerabilities/116488
[3] https://packetstormsecurity.com/files/138571
[4] https://www.exploit-db.com/exploits/40327/
[26.09.2016] - Added reference [1], [2], [3] and [4]
Web: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
Advisory ID: ZSL-2016-5367
Type: Local/Remote
Impact: Security Bypass
Risk: (2/5)
Release Date: 31.08.2016
Summary
ZKBioSecurity3.0 is the ultimate "All in One" web based security platform developed by ZKTeco. It contains four integrated modules: access control, video linkage, elevator control and visitor management. With an optimized system architecture designed for high level biometric identification and a modern-user friendly UI, ZKBioSecurity 3.0 provides the most advanced solution for a whole new user experience.Description
The issue exist due to the way visLogin.jsp script processes the login request via the 'EnvironmentUtil.getClientIp(request)' method. It runs a check whether the request is coming from the local machine and sets the ip variable to '127.0.0.1' if equal to 0:0:0:0:0:0:0:1. The ip variable is then used as a username value with the password '123456' to authenticate and disclose sensitive information and/or do unauthorized actions.Vendor
ZKTeco Inc. - http://www.zkteco.comAffected Version
3.0.1.0_R_230Platform: 3.0.1.0_R_230
Personnel: 1.0.1.0_R_1916
Access: 6.0.1.0_R_1757
Elevator: 2.0.1.0_R_777
Visitor: 2.0.1.0_R_877
Video:2.0.1.0_R_489
Adms: 1.0.1.0_R_197
Tested On
Microsoft Windows 7 Ultimate SP1 (EN)Microsoft Windows 7 Professional SP1 (EN)
Apache-Coyote/1.1
Apache Tomcat/7.0.56
Vendor Status
[18.07.2016] Vulnerability discovered.[27.07.2016] Vendor contacted.
[29.08.2016] No response from the vendor.
[31.08.2016] Public security advisory released.
PoC
zkbiosecurity_local.txtCredits
Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>References
[1] https://cxsecurity.com/issue/WLB-2016090003[2] https://exchange.xforce.ibmcloud.com/vulnerabilities/116488
[3] https://packetstormsecurity.com/files/138571
[4] https://www.exploit-db.com/exploits/40327/
Changelog
[31.08.2016] - Initial release[26.09.2016] - Added reference [1], [2], [3] and [4]
Contact
Zero Science LabWeb: http://www.zeroscience.mk
e-mail: lab@zeroscience.mk
