CVE-2022-36537: ZK Framework Information Disclosure Flaw

CVE-2022-36537 Overview

CVE-2022-36537 is an information disclosure vulnerability affecting multiple versions of the ZK Framework, a popular open-source Ajax web application framework. The vulnerability allows attackers to access sensitive information by sending a crafted POST request to the AuUploader component. This component, designed to handle file uploads within ZK applications, fails to properly validate incoming requests, enabling unauthorized access to sensitive data.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed exploitation by threat actors targeting organizations running vulnerable ZK Framework deployments.

Affected Products

• ZK Framework v9.6.1
• ZK Framework v9.6.0.1, v9.5.1.3, v9.0.1.2
• ZK Framework v8.6.4.1

Discovery Timeline

• 2022-08-26 - CVE-2022-36537 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2022-36537

Vulnerability Analysis

This vulnerability represents an information disclosure flaw in the ZK Framework's AuUploader component. The framework is widely used for building enterprise Java web applications, making this vulnerability particularly impactful across numerous organizational deployments.

The AuUploader component is responsible for handling asynchronous file upload operations within ZK applications. The vulnerability stems from insufficient input validation and access controls on POST requests directed to this component. When exploited, attackers can craft malicious POST requests that bypass intended security boundaries and extract sensitive information from the target application.

The network-accessible nature of this vulnerability, combined with no authentication requirements and low attack complexity, makes it particularly dangerous. An attacker can exploit this remotely without any user interaction or special privileges, making it an attractive target for automated exploitation.

Root Cause

The root cause lies in improper request validation within the AuUploader component. The component fails to adequately verify the legitimacy and scope of incoming POST requests, allowing attackers to manipulate request parameters in ways that expose sensitive information that should otherwise be protected.

Attack Vector

The attack is executed over the network by sending specially crafted POST requests to the vulnerable AuUploader component endpoint. The exploitation path involves:

1. Identifying a target application running a vulnerable version of ZK Framework
2. Locating the AuUploader component endpoint
3. Constructing a malicious POST request with parameters designed to extract sensitive information
4. Parsing the response to retrieve unauthorized data

The vulnerability is exploited remotely and requires no authentication, making reconnaissance and initial access relatively straightforward for attackers. CISA has warned that this vulnerability has been actively exploited by threat actors in real-world attacks, as documented in their Known Exploited Vulnerabilities Catalog.

Detection Methods for CVE-2022-36537

Indicators of Compromise

• Unusual POST requests to AuUploader component endpoints with non-standard parameters
• Increased volume of requests to file upload handlers from single IP addresses
• Unexpected data exfiltration patterns in egress network traffic
• Error log entries indicating malformed or suspicious upload requests

Detection Strategies

• Deploy web application firewall (WAF) rules to inspect and filter suspicious POST requests targeting ZK Framework components
• Implement anomaly detection for unusual request patterns to AuUploader endpoints
• Monitor application logs for unauthorized access attempts and error messages related to file upload components
• Configure intrusion detection systems (IDS) with signatures for CVE-2022-36537 exploitation patterns

Monitoring Recommendations

• Enable detailed request logging for all ZK Framework component endpoints
• Set up real-time alerting for requests matching known exploitation patterns
• Monitor for reconnaissance activity scanning for ZK Framework applications
• Track network connections to known threat actor infrastructure associated with this vulnerability

How to Mitigate CVE-2022-36537

Immediate Actions Required

• Identify all instances of ZK Framework in your environment and determine their version numbers
• Apply vendor patches immediately for all vulnerable installations
• Implement network-level controls to restrict access to AuUploader endpoints where possible
• Enable enhanced logging and monitoring for ZK Framework applications

Patch Information

ZKOSS has released security patches addressing this vulnerability. Organizations should upgrade to patched versions immediately. The vendor has documented this issue in their ZKOSS Issue Tracker Entry, which provides specific remediation guidance and patched version information. Given the active exploitation status and CISA KEV listing, patching should be treated as a critical priority.

Workarounds

• Restrict network access to ZK Framework applications using firewall rules to limit exposure
• Implement strict input validation at the web server or reverse proxy level for requests to AuUploader
• Consider temporarily disabling the AuUploader component if file upload functionality is not business-critical
• Deploy a WAF with rules specifically blocking crafted POST requests targeting this vulnerability

# Example: Restrict access to AuUploader endpoint via Apache configuration
<Location "/zkau">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>