The ZK Framework is an open source Java framework that is used in multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity flaw affecting the ZK Framework to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation.
Tracked as CVE-2022-36537 (CVSS score: 7.5), the issue impacts ZK Framework versions 9.6.1, 184.108.40.206, 220.127.116.11, 18.104.22.168, and 22.214.171.124, and allows threat actors to retrieve sensitive information via specially crafted requests. The vulnerability was patched in May 2022 in versions 9.6.2, 126.96.36.199, 188.8.131.52, 184.108.40.206, and 220.127.116.11. As demonstrated by Huntress in a proof-of-concept (PoC) in October 2022, the vulnerability can be weaponized to bypass authentication, upload a backdoored JDBC database driver to gain code execution, and deploy ransomware on susceptible endpoints.
Singapore-based Numen Cyber Labs, in addition to publishing a PoC of its own in December 2022, cautioned that it found more than 4,000 Server Backup Manager instances exposed on the internet. The vulnerability has since come under mass exploitation, as evidenced by NCC Group's Fox-IT research team last week, to obtain initial access and deploy a web shell backdoor on 286 servers.
If you are using any products that utilize the ZK Framework, it is important to update to the patched versions as soon as possible to avoid becoming a victim of this exploitation.