Secure versions

This vulnerability is resolved in versions:

• 9.6.2
• 9.6.0.2 (security release)
• 9.5.1.4 (security release)
• 9.0.1.3 (security release)
• 8.6.4.2 (security release)

Workaround

download attached classes, and add them to application in their declared package.

• For ZK 8.6.0.1 to 9.6.1: use zk8601-to-zk961-patch.zip
• For ZK 8.0.2 to 8.6.0: use zk802-to-zk8600-patch.zip
• For ZK 8.0.1 and before: contact [email protected]
   

register in zk.xml

	<listener>
	    <listener-class>org.zkoss.support.patch.AuUploadWebAppInit</listener-class>
	</listener>
	
	<system-config>
		<file-item-factory-class>org.zkoss.support.patch.UploadFixItemFactory</file-item-factory-class>
	</system-config>

Vulnerability details

Thanks to Markus Wulftange of Code White GmbH for discovering and reporting this issue, as well as cooperating with us in its resolution.

ZK AuUploader servlets contains a security vulnerability which can be exploited to retrieve the content of a file located in the web context. This includes files normally hidden from the user located in WEB-INF, such as web.xml, zk.xml, etc.

In the unsecure versions, an attacker may send a forged request to the /zkau/upload endpoint.
If the forged request contains the nextURI parameter, the AuUploader will try to forward the request internally, and output the document found if any into the response.

Since this is an internal forward, it can access documents located in restricted WEB-INF folder, which exposes internal files such as web.xml, zk.xml and other files located in this directory.

This vulnerability affects ZK versions below the secure version list provided above.

The secure list contains security releases for ZK branches from 8.6.X up to 9.6.0.X, and the main release 9.6.2

National Vulnerability Database (NVD)

This bug is recorded as CVE-2022-36537