CVE-2022-36537 ZK Framework AuUploader: dangerous file upload
In plain words: The program accepts files it should refuse, such as programs disguised as ordinary uploads. The attacker can place and run their own tools on the server.
Confirmed exploited by CISA on · US federal patch deadline Mar 20, 2023
What to do
- Install ZK Framework's security update for AuUploader. If no update exists, follow the vendor's workaround or stop using the product until one ships.
- Keep a list of every internet-facing server you run so nothing is forgotten.
- Patch anything in this catalog first, ahead of normal patch cycles.
- Put admin and file-transfer apps behind a VPN or single sign-on instead of the open internet.
Who is affected
Work IT. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.
What's at risk: Mass data theft and ransomware: a single flaw in a file-transfer or email server has exposed thousands of organisations at once.
The details
- Official name
- ZK Framework AuUploader Unspecified Vulnerability
- Product
- ZK Framework AuUploader
- CISA description
- ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager.
- Type of flaw
- Dangerous file upload (CWE-441)
- Confirmed exploited
- Feb 27, 2023 — known to be used in ransomware attacks
- US federal patch deadline
- Mar 20, 2023
Ask Cleus about it
Ask about a vulnerability, an update, a weird message, or the news. Plain-word answers, free, no account.
Answering about CVE-2022-36537 ·
Questions about CVE-2022-36537
Is CVE-2022-36537 being exploited?
Yes. CISA added CVE-2022-36537 to its Known Exploited Vulnerabilities catalog on Feb 27, 2023, which means there is reliable evidence of real-world attacks, including by ransomware groups.
How do I fix CVE-2022-36537?
Install ZK Framework's security update for AuUploader. If no update exists, follow the vendor's workaround or stop using the product until one ships. Keep a list of every internet-facing server you run so nothing is forgotten.
Am I affected by CVE-2022-36537?
Only if you use ZK Framework AuUploader. Aimed mostly at company systems — you are affected through the companies you use, not your own phone.