CVE-2022-36537: ZK Framework AuUploader Unspecified Vulnerability

CVE-2022-36537 is an unspecified vulnerability in the AuUploader component of the ZK Framework, an open-source Java framework used to build web applications. It can allow an attacker to retrieve the content of a file located in the web context. Because the ZK Framework is embedded in multiple products, including ConnectWise R1Soft Server Backup Manager and others, the issue can surface across different enterprise systems. CISA notes known ransomware use of this vulnerability, so unpatched instances present a clear risk of unauthorized file access that can support further compromise.

Defenders should treat any deployment of ZK Framework AuUploader servlets as potentially exposed until the vendor-supplied update is confirmed and applied. Specifics on exact product versions and configurations must be verified against the relevant vendor advisory.

How it works

The weakness is classified as CWE-441 (Unintended Proxy or Intermediary). In this case the AuUploader servlets act as an intermediary that can be abused to retrieve file content from the web context. An attacker who can reach the vulnerable servlet can cause it to return the contents of a file that should not be directly accessible, effectively turning the component into an unintended proxy for local file disclosure.

No further exploit mechanics are provided in public summaries. The practical impact is unauthorized reading of files within the application's web context, which may include configuration data, credentials, or other sensitive material depending on what resides there. Confirm the precise attack surface and any required preconditions against the vendor advisory for the product in use.

Am I affected? How to find it in your systems

ZK Framework is commonly found in Java-based web applications and can be packaged inside commercial products such as ConnectWise R1Soft Server Backup Manager. Inventory efforts should therefore cover both custom Java applications that declare a dependency on ZK Framework and any third-party products known to embed it.

• Search software inventories, package manifests, and dependency trees for ZK Framework or AuUploader-related components.
• Examine web application deployments for servlets or endpoints associated with AuUploader.
• Review product documentation and version information for any listed products (for example ConnectWise R1Soft Server Backup Manager) and cross-check against the vendor advisory to determine whether the installed release is affected.
• Where possible, inspect application configuration or deployment descriptors for references to AuUploader servlets.

Telemetry signs of exploitation are not detailed in the available summary. Monitor web server and application logs for unusual requests targeting AuUploader endpoints or for unexpected file-read activity originating from the application process. Any anomalous access to files under the web context should be investigated promptly.

How to remediate

The primary remediation is to apply the updates provided by the vendor, as directed by CISA. Obtain the patched release or security update for every product that incorporates the vulnerable ZK Framework AuUploader component and deploy it according to the vendor's instructions.

• Identify all instances of the affected framework or product.
• Download and test the vendor-supplied update in a non-production environment where feasible.
• Roll out the update to production systems, verifying that the AuUploader component is no longer vulnerable.
• After patching, re-inventory to confirm no residual vulnerable instances remain.

Once the update is applied, review and harden the surrounding configuration: restrict the web context so that only necessary files are present, enforce least-privilege permissions on the application process, and ensure that any file-upload or servlet functionality is limited to authenticated and authorized users.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls appropriate to this class of file-disclosure vulnerability.

• Segment the affected systems so that the AuUploader endpoints are reachable only from trusted management networks or authenticated clients.
• Apply virtual patching or WAF rules that block or tightly restrict requests to AuUploader servlets; tune rules carefully to avoid breaking legitimate functionality.
• If the product allows it, disable the AuUploader feature or remove the servlet mapping entirely until a patch is available.
• Increase monitoring and alerting on the application and web-server logs for any access attempts against the vulnerable endpoints or for unexpected file reads.
• Limit the files present in the web context and ensure sensitive material is stored outside it.

These measures lower risk but do not eliminate it; schedule the official update as soon as operationally possible.

If your data may have been exposed

Actively exploited vulnerabilities, including those with known ransomware use, frequently lead to data breaches. If systems running the vulnerable AuUploader component were internet-facing or otherwise reachable by untrusted parties, assume that files within the web context may have been retrieved. Review access logs, investigate for signs of follow-on activity, and follow your incident-response procedures. As an additional check, you can run a free exposure scan of your email addresses against known breach data to determine whether related credentials or personal information have already appeared in public breach corpora.