QNAP Turbo NAS 3.6.1 Build 0302T multiple defects and repair

Source: Internet
Author: User

Affected Product QNAP
 
Platform Turbo NAS (verified) and possibly others
 
Affected Version. Firmware Version: 3.6.1 Build 0302 T and prior
 
Severity Rating. High
 
Impact. Exposure of sensitive information
 
Exposure of system information
 
Privilege escalation
 
System access
 
Attack Vector. Remote with authentication
 
Solution. Not officially upgraded
Technical Analysis

QNAP provide NAS technology solutions to consumers and their ISES.
 
Multiple vulnerabilities have been identified in the web management
 
Interface.
 

 
1. Command Injection
 
The QNAP Download Station (QDownload) is vulnerable to command injection
 
As the application executes user-controllable data that is processed
 
A shell command interpreter.
 

 
The following resources, accessible post authentication are affected:
 
Www.2cto.com/cgi-bin/Qdownload/DS_RSS_Option.cgi [keyword parameter]
 
/Cgi-bin/Qdownload/DS_RSS_Option.cgi [title parameter]
 
Commands are executed with the context of the admin user [uid = 0 (admin)
 
Gid = 0 (administrators] on the QNAP device.
 
Test proof
 
/Cgi-bin/Qdownload/DS_RSS_Option.cgi? _ Dc = 1331164660690 & url = http % 3A % 2F % 2F
 
Google.com & title = test & keyword = 'touch % 20% 2 ftesto % 2etxt '& todo = add & sid = i9
 
Nonapr & ver= 2.0
 

 
2. Password
 
The QNAP login page stores persistent cookies (including the administrator
 
Username and password) as base64 encoded strings inside the cookie
 
Parameter nas_p. These cookies are not protected with either the HTTPOnly
 
Or Secure flags allowing theft via one of the specified cross-site scripting
 
Vulnerabilities which exist within the application (disclosed previusly
 
By another researcher, but never fixed ).
 

 
Test proof.
 
Cookie: qnap_admin_style = default; nas_save_u = 1; nas_u = bGFicw =;
 
Nas_address = 10.1.1.2; nas_save_p = 1; nas_p = YWRtaW5UMG1iJTI0dDBuMw =;
 
Nas_tree_x = 240; nas_tree_y = 370
 
YWRtaW5UMG1iJTI0dDBuMw = decodes to admin123qweasd
 
Discovered.
 
Nadeem Salim and Phil Taylor from Sense of Security Labs.
 
Follow these updates
 
Http://www.senseofsecurity.com.au/advisories/SOS-12-006.pdf
 

 
Other Sense of Security advisories can be found:
 
Http://www.senseofsecurity.com.au/research/it-security-advisories.php

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.