Unwanted output from /zkau?dtid=

asked 2014-01-16 07:33:12 +0800

onjo
3

Hi.

We had a security/penetration audit on our ZK 6.5 WebApp. One of the issues is output from request /zkau?dtid=... which at simplest (no dtid value) returns {"rs":[]} When more parameters used - like /zkau?dtid=znko&cmd0=onChange&uuid0=bQ9Ql&data0=0 the output is more complex.

The main concern about this fact is that this output is available even for not authenticated user and could be abused by attacker to target his attack more precisely by providing clues on possible code design.

I would like to know, how is possible to deny access to this with some zk settings or in zk source code( by generating HTTP 403 error ) or at least to deny access for not authenticated users.

Thank you in advance.