CVE-2024-22988: Zkteco Zkbio WDMS Information Disclosure

CVE-2024-22988 Overview

CVE-2024-22988 is a critical information disclosure vulnerability affecting ZKTeco ZKBio WDMS (Workforce Device Management System) versions prior to 9.0.2 Build 20250526. The vulnerability exists in the /files/backup/ component, which allows unauthenticated attackers to download database backup files due to predictable timestamp-based filenames. This insecure direct object reference combined with broken access control enables attackers to access sensitive organizational data without authentication.

Critical Impact

Unauthenticated remote attackers can download complete database backups containing sensitive workforce management data, employee records, access control configurations, and potentially authentication credentials by predicting backup file timestamps.

Affected Products

• ZKTeco ZKBio WDMS versions before 9.0.2 Build 20250526
• ZKTeco ZKBio WDMS version 8.0.5 (confirmed vulnerable)

Discovery Timeline

• 2024-02-23 - CVE-2024-22988 published to NVD
• 2025-06-07 - Last updated in NVD database

Technical Details for CVE-2024-22988

Vulnerability Analysis

The vulnerability stems from a fundamental access control flaw in ZKBio WDMS's backup file handling mechanism. The application stores database backup files in the /files/backup/ directory with filenames that are generated using predictable timestamp patterns. Since these filenames follow a deterministic naming convention based on the time of backup creation, an attacker can enumerate possible backup filenames by iterating through timestamp values.

The lack of authentication requirements on the backup directory compounds this issue significantly. Any network-accessible attacker can directly request backup files without providing valid credentials. When combined with the predictable filename generation, this creates a trivially exploitable pathway to exfiltrate complete database dumps.

ZKBio WDMS is a workforce and device management platform commonly used to manage biometric time attendance systems, access control devices, and employee records. Database backups from such systems typically contain highly sensitive information including employee personal data, biometric enrollment information, access schedules, and system configurations.

Root Cause

The root cause is twofold: first, the application uses an insecure naming convention for backup files based on predictable timestamps rather than cryptographically random identifiers. Second, the /files/backup/ endpoint lacks proper authentication and authorization controls, allowing unauthenticated access to sensitive backup files. This represents a failure to implement defense in depth, as neither layer provides adequate protection against unauthorized file access.

Attack Vector

The attack can be executed remotely over the network without any authentication requirements. An attacker would enumerate the /files/backup/ directory by generating potential backup filenames based on likely timestamps. Since backup operations typically occur at scheduled intervals (daily, weekly), attackers can narrow down the search space significantly. Once a valid filename is guessed, the complete database backup can be downloaded directly via HTTP GET requests.

The exploitation process involves:

1. Identifying a target ZKBio WDMS installation accessible over the network
2. Generating candidate backup filenames based on timestamp patterns
3. Iterating through candidate URLs targeting /files/backup/[timestamp-based-filename]
4. Downloading any successfully located backup files
5. Extracting sensitive data from the acquired database dumps

For detailed technical analysis and proof-of-concept information, refer to the Vicarius Blog CVE-2024-22988 Analysis and the GitHub Gist PoC Code.

Detection Methods for CVE-2024-22988

Indicators of Compromise

• Unexpected HTTP requests to /files/backup/ paths from external IP addresses
• High volume of HTTP 404 responses from the backup directory indicating enumeration attempts
• Successful HTTP 200 responses for backup file requests from unauthorized sources
• Unusual outbound data transfers from the ZKBio WDMS server
• Access log entries showing sequential timestamp-pattern requests to the backup endpoint

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block enumeration patterns targeting the /files/backup/ directory
• Configure IDS/IPS signatures to alert on rapid sequential requests to backup file paths
• Monitor access logs for requests containing backup file extensions or timestamp patterns from non-administrative IP addresses
• Deploy network traffic analysis to identify large file downloads from the WDMS server to unexpected destinations

Monitoring Recommendations

• Enable detailed access logging on the ZKBio WDMS application server and forward logs to a SIEM platform
• Create alerting rules for any access to the /files/backup/ directory that does not originate from authorized administrative hosts
• Implement file integrity monitoring on the backup directory to track access patterns
• Establish baseline network traffic patterns and alert on anomalous data exfiltration volumes

How to Mitigate CVE-2024-22988

Immediate Actions Required

• Upgrade ZKBio WDMS to version 9.0.2 Build 20250526 or later immediately
• If immediate patching is not possible, restrict network access to the /files/backup/ directory using firewall rules or web server configuration
• Review access logs for evidence of prior exploitation or enumeration attempts
• Rotate any credentials stored in the database if compromise is suspected
• Implement network segmentation to limit exposure of the WDMS server

Patch Information

ZKTeco has addressed this vulnerability in ZKBio WDMS version 9.0.2 Build 20250526. Organizations should upgrade to this version or later to remediate the vulnerability. Refer to the ZKTeco Security Bulletin #12 for official guidance and download links. Additional product information is available on the ZKTeco Official Website.

Workarounds

• Configure web server access controls to deny unauthenticated requests to /files/backup/* paths
• Implement IP-based allowlisting to restrict backup directory access to specific administrative hosts only
• Place the ZKBio WDMS server behind a reverse proxy with authentication requirements for sensitive paths
• Consider moving backup files to a non-web-accessible location and using secure file transfer protocols for backup retrieval
• Implement rate limiting on the web server to slow enumeration attempts

# Example Apache .htaccess restriction for /files/backup/
<Directory "/var/www/zkbio/files/backup">
    Order deny,allow
    Deny from all
    Allow from 10.0.0.0/8
    Allow from 192.168.1.0/24
</Directory>