What this checks: whether a ZK Framework (zkoss) host runs a version affected by unauth AuUploader information disclosure / arbitrary file read. Read-only: it fingerprints ZK Framework (zkoss) and reads the version, no exploitation.
3. Detection — reads the ZK Framework (zkoss) version from the product's default response and version banner, compares to per-branch: 8.6.4.2 / 9.0.1.3 / 9.5.1.4 / 9.6.0.2 / 9.6.2 (10.x unaffected). Flags vulnerable on an affected build. No exploitation.
1. Target List — paste your ZK Framework (zkoss) URLs here, one per line (e.g. https://host.example.com).
Overview
This workflow finds ZK Framework (zkoss) and sorts each host by whether its version falls below the CVE-2022-36537 fixed floors. CVE-2022-36537 is unauthenticated AuUploader information disclosure and arbitrary file read on vulnerable ZK Framework builds. This check never reads a file through AuUploader and never sends an exploit. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow fingerprints ZK Framework from the product default response and version banner, parses the version, and compares it to the per-branch floors in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. An affected row is a version signal only.
Run it on a schedule when ZK-backed apps turn over. A restored node that still ships a pre-floor 9.6 build is the reason the same fingerprint stays useful.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
Fetch each host and fingerprint ZK Framework from the product default response and version banner.
Parse the version and compare it to the CVE-2022-36537 per-branch floors in the graph.
Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, vulnerable, and errors.
Inputs
Target scope. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether ZK Framework was detected, the version read, the vulnerable flag, and detail text.
findings.jsonl. The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
summary.json. Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.
Integrations
HTTP. Unauthenticated fingerprint of the product default response and version banner only. No AuUploader file-read PoC and no authentication.
Sample output
The records below are illustrative and do not come from a real run. They show one ZK Framework host below a CVE-2022-36537 floor, one at or above its branch floor, and one host that is not the product.
Builds below the per-branch floors in the graph: 8.6.4.2, 9.0.1.3, 9.5.1.4, 9.6.0.2, and 9.6.2. A version picks the matching band, then compares to that band floor. The graph treats 10.x as unaffected. The compare uses the version the default response and banner themselves served.
Does an affected row mean AuUploader file read worked?
No. The check only fingerprints ZK Framework and reads the version. It does not call AuUploader to read a file, does not authenticate, and does not confirm disclosure.
Is this check safe on production?
Yes. It is a read-only unauthenticated HTTP fingerprint of the public product response. It does not upload or download through AuUploader.
Does the check need credentials?
No. It fingerprints the public default response the way an external scanner would.
What is CVE-2022-36537?
Unauthenticated AuUploader information disclosure and arbitrary file read on vulnerable ZK Framework (zkoss) builds. This workflow maps hosts to that CVE by version exposure only.