CVE-2023-31861
📋 TL;DR
CVE-2023-31861 is a directory traversal vulnerability in ZLMediaKit 4.0 that allows attackers to read arbitrary files outside the intended directory. This affects all systems running ZLMediaKit 4.0 with default configurations. Attackers can exploit this to access sensitive system files.
💻 Affected Systems
- ZLMediaKit
📦 What is this software?
Zlmediakit by Zlmediakit
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through reading sensitive files like /etc/passwd, SSH keys, or configuration files containing credentials.
Likely Case
Unauthorized access to sensitive application files, configuration data, or user information stored on the server.
If Mitigated
Limited impact with proper file permissions and network segmentation preventing access to critical system files.
🎯 Exploit Status
Public proof-of-concept code exists showing simple HTTP requests with directory traversal sequences.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 4.0 (check latest release)
Vendor Advisory: https://github.com/ZLMediaKit/ZLMediaKit/security/advisories
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update to latest ZLMediaKit version. 3. Restart ZLMediaKit service. 4. Verify fix with test requests.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to filter directory traversal sequences in request paths
# Configure web server to reject requests with ../ sequences
# Add input validation in application code
File Permission Restriction
linuxRun ZLMediaKit with minimal file system permissions
# Run as non-root user
sudo chown -R zlmediakit:zlmediakit /path/to/media
sudo chmod 750 /path/to/media
🧯 If You Can't Patch
- Implement WAF rules to block directory traversal patterns
- Isolate ZLMediaKit server in restricted network segment
🔍 How to Verify
Check if Vulnerable:
Test with HTTP request containing directory traversal like GET /../../etc/passwdCheck Version:
zlmediakit --version or check version in web interfaceVerify Fix Applied:
Attempt same traversal requests and verify they return 403/404 errors instead of file contents📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing ../ sequences
- Access to unexpected file paths
- 403/404 errors for traversal attempts
Network Indicators:
- HTTP requests with multiple ../ sequences in URL
- Unusual file access patterns
SIEM Query:
source="zlmediakit" AND (url="*../*" OR status=403)