CVE-2023-38950

What it actually does

CVE-2023-38950 is an unauthenticated path traversal vulnerability in the ZKTeco BioTime iclock API. A remote attacker can submit crafted path sequences to escape the intended application directory and cause the server to return arbitrary local files readable by the BioTime application process. The primary impact is confidentiality loss: sensitive configuration files, application source, credentials, keys, logs, database connection details, operating-system files, and other local data may be exposed. The CVSS vector indicates network exploitation, low complexity, no privileges, no user interaction, unchanged scope, and high confidentiality impact, with no direct integrity or availability impact.

Why it matters to the business

Successful exploitation can expose sensitive employee, attendance, biometric-adjacent, identity, infrastructure, and credential data managed or accessible by BioTime systems. Stolen configuration secrets may allow attackers to pivot into databases, administrative interfaces, or adjacent systems even though the vulnerability itself is file-read only. The vulnerability is listed in CISA KEV with a remediation due date of 2025-06-09, has high EPSS likelihood, and is reported as actively exploited in the wild, so internet-facing or partner-accessible BioTime deployments should be treated as urgent exposure risks.

How an attack unfolds

An attacker first identifies a reachable ZKTeco BioTime instance and probes the iclock API without authentication. They then submit requests containing directory traversal sequences intended to break out of the expected API file path context. If the application fails to normalize and restrict the requested path, it reads and returns files from elsewhere on the server. The attacker typically starts with harmless operating-system fingerprint files, then attempts to retrieve application configuration, logs, source files, database settings, credential material, and other secrets. Any recovered credentials or internal details may then be used for follow-on access, lateral movement, or data theft. Public reporting and KEV status indicate active exploitation, so organizations should assume opportunistic scanning and exploitation attempts may target exposed BioTime servers.

How to fix it

Upgrade ZKTeco BioTime to a vendor-supported release that remediates this issue. No fixed version was provided in the input, so confirm the corrected version directly with ZKTeco support or official advisories and apply the latest available security update. If immediate patching is not possible, restrict network access to BioTime and the iclock API to trusted management networks or required device IP ranges only; remove public internet exposure; place the service behind a VPN, reverse proxy, or access control layer; block traversal patterns at a WAF or proxy; and monitor for suspicious requests. Rotate credentials and secrets stored on or accessible from affected BioTime servers if exploitation is suspected or cannot be ruled out. Harden the host by limiting the file permissions of the BioTime service account so it cannot read unnecessary sensitive files.

How to confirm the fix worked

Confirm the installed BioTime version is not vulnerable and is on a vendor-supported fixed release. Review externally exposed assets and verify BioTime and the iclock API are not reachable from untrusted networks unless explicitly required and protected. From an authorized test environment, send benign negative test requests containing traversal-like sequences to the iclock API and confirm they are rejected with an error rather than returning local file contents. Validate WAF, reverse proxy, and application logs show blocked or sanitized traversal attempts. Confirm file permissions for the BioTime service account are least-privilege. After remediation, rerun authenticated and unauthenticated vulnerability scans, confirm no arbitrary local file content is returned, and review logs for historical exploitation attempts before considering the issue closed.

Typical attack path

1. Scan the internet or known enterprise ranges for exposed ZKTeco BioTime services.
2. Confirm the BioTime web application and iclock API are reachable without authentication.
3. Send crafted requests containing path traversal sequences to the iclock API.
4. Validate file-read behavior by requesting predictable operating-system or application files.
5. Retrieve sensitive application configuration, logs, source files, credential files, or database connection details.
6. Use exposed secrets or internal information to access databases, administrator consoles, or adjacent systems.
7. Exfiltrate sensitive employee, attendance, identity, or operational data and potentially maintain access through stolen credentials.

How to detect it

Investigate web server, application, reverse proxy, WAF, load balancer, and network logs for unauthenticated requests to BioTime iclock API paths containing traversal sequences or attempts to retrieve known sensitive files. Prioritize requests with ../, encoded traversal variants, repeated probing of different path depths, or references to operating-system files such as /etc/passwd, /etc/shadow, win.ini, boot.ini, web.config, application configuration files, database configuration files, or log files. Review successful HTTP 200 responses with unusually large response sizes or text-file content types for iclock API requests. Correlate source IPs with repeated traversal attempts, subsequent login attempts, database connections, or administrative access. On hosts, review EDR/file-access telemetry for the BioTime application process reading files outside expected application directories. If exploitation may have succeeded, examine application configuration exposure, credential use after the suspicious requests, database access logs, and outbound connections from the BioTime server. Because this vulnerability is actively exploited and in KEV, absence of WAF blocks alone is not sufficient; check origin web logs and host telemetry where available.

• /iclock/
• ../
• ..\\
• %2e%2e%2f
• %2e%2e/
• ..%2f
• %2e%2e%5c
• ..%5c
• %252e%252e%252f
• %c0%ae%c0%ae%c0%af
• /etc/passwd
• /etc/shadow
• /etc/hosts
• /proc/self/environ
• C:\\Windows\\win.ini
• C:\\boot.ini
• C:\\Windows\\System32\\drivers\\etc\\hosts
• web.config
• settings.py
• config.ini
• database.ini
• application.properties
• jdbc.properties
• db.properties
• HTTP requests to /iclock/ containing ../
• HTTP requests to /iclock/ containing %2e%2e
• HTTP requests to /iclock/ containing /etc/passwd
• HTTP requests to /iclock/ containing win.ini

What your security team should do

• Treat exposed ZKTeco BioTime systems as high priority because the vulnerability is in CISA KEV, has high EPSS probability, and is actively exploited in the wild.
• Immediately identify all BioTime deployments, especially internet-facing, partner-accessible, VPN-accessible, or device-network-accessible instances.
• Upgrade to the latest vendor-supported BioTime release that fixes the iclock API path traversal flaw; confirm the exact fixed version with ZKTeco if not already documented internally.
• Until patched, restrict access to BioTime and the iclock API to trusted IP ranges and required ZKTeco device networks only.
• Add temporary WAF or reverse-proxy rules to block traversal sequences such as ../, encoded dot-dot-slash variants, and requests for sensitive OS or application files.
• Review web, proxy, WAF, EDR, and host logs for prior exploitation attempts and successful file reads.
• If suspicious access is found, rotate BioTime application credentials, database credentials, API keys, service account passwords, and any secrets stored in readable configuration files.
• Check for follow-on activity using any exposed credentials, including database logins, administrator portal access, remote access attempts, and unusual outbound connections from the BioTime host.
• Increase monitoring on affected servers for unexpected file access, suspicious web requests, and anomalous authentication from BioTime-related accounts.
• Document KEV-driven remediation status and ensure remediation is completed no later than the CISA due date of 2025-06-09 where applicable.