CVE-2022-36537
ZK Framework AuUploader Unspecified Vulnerability
Description
CVE-2022-36537 is an information disclosure vulnerability in ZK Framework that allows unauthenticated attackers to access sensitive information via a crafted POST request sent to the AuUploader component. Affected versions include ZK Framework 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2, and 8.6.4.1. This vulnerability is particularly dangerous because it has been associated with ransomware campaigns and is actively exploited in the wild. With a CVSS v3.1 score of 7.5 (High severity) and an EPSS score of 93.9% (99.9th percentile), CVE-2022-36537 has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of March 20, 2023.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| zkoss | zk framework | < 8.6.4.2; >= 9.0.0, < 9.0.1.3; >= 9.5.0, < 9.5.1.3; >= 9.6.0, < 9.6.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://tracker.zkoss.org/browse/ZK-5150(Issue Tracking, Patch, Vendor Advisory)
- https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-zk-java-framework-rce-flaw/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-36537(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2022-36537 by NVD. The vulnerability involves improper access control in the ZK Framework's AuUploader component, which fails to properly restrict access to sensitive information when processing crafted POST requests. This type of weakness is generally classified under information exposure or improper access control categories.
Impact Analysis
CVE-2022-36537 carries a CVSS v3.1 score of 7.5 (High severity), reflecting the significant confidentiality risk it poses. Attack Vector (Network): The vulnerability is exploitable remotely over the network through HTTP POST requests to the AuUploader component, making any internet-facing application built on the ZK Framework a potential target. Attack Complexity (Low): No special conditions, timing, or preparation are required to exploit this flaw. Privileges Required (None): No authentication is needed, meaning any remote attacker can craft and send the malicious POST request. User Interaction (None): No action from a legitimate user is required to trigger the exploit. Confidentiality Impact (High): Successful exploitation allows the attacker to access sensitive information stored in or accessible through the ZK Framework application, potentially including configuration files, session data, and internal application details. Integrity Impact (None): The vulnerability does not directly allow data modification. Availability Impact (None): The vulnerability does not directly affect system availability. Despite the focused confidentiality-only impact, the EPSS score of 93.9% (99.9th percentile) and the confirmed association with ransomware campaigns make CVE-2022-36537 a critical remediation priority.
Exploit Maturity
CVE-2022-36537 has confirmed active exploitation in the wild and is associated with ransomware operations. CISA added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 20, 2023, and specifically flagged it as having a known ransomware association. BleepingComputer has reported on hackers actively exploiting the ZK Java Framework RCE flaw, highlighting the widespread targeting of applications built on the vulnerable ZK Framework versions. The EPSS score of 93.9% (99.9th percentile) confirms the extremely high probability of exploitation. The vendor has published a patch tracker entry (ZK-5150) documenting the vulnerability and its fix. The combination of unauthenticated access, ransomware usage, and broad exploitation makes this one of the highest-risk vulnerabilities for organizations running ZK Framework applications.
Remediation
- Update ZK Framework to a patched version immediately. The KEV required action states: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Upgrade to ZK Framework versions 9.6.2, 9.6.0.2, 9.5.1.4, 9.0.1.3, or 8.6.4.2 (or later), which address the AuUploader vulnerability.
- Identify all applications using the ZK Framework in your environment. The ZK Framework is a Java web framework used to build enterprise applications, so the vulnerability may affect multiple internal and external-facing applications. Conduct an inventory to ensure all instances are patched.
- Restrict network access to ZK Framework applications. Where possible, limit exposure of ZK Framework-based applications to trusted networks. Use network segmentation and access controls to reduce the attack surface.
- Deploy web application firewall (WAF) rules. Implement WAF rules to detect and block crafted POST requests targeting the AuUploader component. Filter requests containing suspicious payloads directed at ZK Framework endpoints.
- Monitor for indicators of compromise and ransomware activity. Given the confirmed ransomware association, review systems running ZK Framework applications for signs of unauthorized access, data exfiltration, lateral movement, or ransomware deployment. Check application logs for unusual POST requests to AuUploader endpoints.
Technical Details
CVE-2022-36537 targets the AuUploader component of the ZK Framework, an open-source Java web framework used to build enterprise web applications. Attack Vector (Network): The vulnerability is triggered by sending a specially crafted HTTP POST request to the AuUploader servlet endpoint. No Authentication Required: The AuUploader component does not require authentication for the vulnerable code path, allowing any remote attacker to send the crafted request. Information Disclosure Mechanism: The crafted POST request exploits a flaw in how AuUploader processes incoming data, causing the component to expose sensitive information that should not be accessible to unauthenticated users. This can include application configuration details, internal file paths, session tokens, and other sensitive data depending on the specific application built on the ZK Framework. Exploitation Chain: In practice, attackers have used the information obtained through CVE-2022-36537 as an initial foothold to further compromise the target system, escalate privileges, and in some cases deploy ransomware. The affected versions span multiple release branches (9.6.x, 9.5.x, 9.0.x, and 8.6.x), indicating that the vulnerable code has been present in the framework for a significant period across major version lines.
Frequently Asked Questions
Is CVE-2022-36537 being actively exploited?
Yes, CVE-2022-36537 is actively exploited in the wild and has been specifically linked to ransomware campaigns. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 20, 2023. BleepingComputer has reported on widespread exploitation targeting ZK Framework applications.
What products are affected by CVE-2022-36537?
CVE-2022-36537 affects ZK Framework versions 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2, and 8.6.4.1. Any web application built using these versions of the ZK Framework is potentially vulnerable. The flaw is in the AuUploader component, which is a core part of the framework.
How do I fix CVE-2022-36537?
Upgrade the ZK Framework to a patched version: 9.6.2, 9.6.0.2, 9.5.1.4, 9.0.1.3, or 8.6.4.2 (or later). Identify all applications in your environment that use ZK Framework and ensure each is updated. Deploy WAF rules and restrict network access as additional protections. See the Remediation section for detailed steps.
How severe is CVE-2022-36537?
CVE-2022-36537 is rated High severity with a CVSS v3.1 score of 7.5. While the direct impact is limited to confidentiality (information disclosure), the vulnerability is actively used in ransomware attack chains, making the real-world impact much more severe. The EPSS score of 93.9% (99.9th percentile) confirms near-certain exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.