exploit the possibilities

QNAP Command Injection

QNAP Command Injection
Posted Jun 17, 2012
Authored by Phil Taylor, Nadeem Salim | Site senseofsecurity.com.au

QNAP Turbo NAS with firmware versions 3.6.1 Build 0302T and below suffer from a command injection vulnerability that allows for remote code execution.

tags | exploit, remote, code execution
MD5 | 9f7cfd7b0e050085ff3d722d9f40f1d3

QNAP Command Injection

Change Mirror Download
Sense of Security - Security Advisory - SOS-12-006

Release Date. 13-Jun-2012
Last Update. -
Vendor Notification Date. 12-Mar-2012
Product. QNAP
Platform. Turbo NAS (verified) and possibly others
Affected versions. Firmware Version: 3.6.1 Build 0302T and prior
Severity Rating. High
Impact. Exposure of sensitive information
Exposure of system information
Privilege escalation
System access
Attack Vector. Remote with authentication
Solution Status. Currently no software update;
vendor has elected not to fix at this time
CVE reference. CVE - not yet assigned

Details.
QNAP provide NAS technology solutions to consumers and enterprises.
Multiple vulnerabilities have been identified in the web management
interface.

1. Command Injection:
The QNAP Download Station (QDownload) is vulnerable to command injection
as the application executes user-controllable data that is processed by
a shell command interpreter.

The following resources, accessible post authentication are affected:
/cgi-bin/Qdownload/DS_RSS_Option.cgi [keyword parameter]
/cgi-bin/Qdownload/DS_RSS_Option.cgi [title parameter]
Commands are executed with the context of the admin user [uid=0(admin)
gid=0(administrators] on the QNAP device.

Proof of Concept.
/cgi-bin/Qdownload/DS_RSS_Option.cgi?_dc=1331164660690&url=http%3A%2F%2F
google.com&title=test&keyword=`touch%20%2ftesto%2etxt`&todo=add&sid=i9
nonapr&ver=2.0

2. Cryptography:
The QNAP login page stores persistent cookies (including the administrator
username and password) as base64 encoded strings inside the cookie
parameter nas_p. These cookies are not protected with either the HTTPOnly
or Secure flags allowing theft via one of the many cross-site scripting
vulnerabilities which exist within the application (disclosed previously
by another researcher, but never fixed).

Proof of Concept.
Cookie: qnap_admin_style=default; nas_save_u=1; nas_u=bGFicw==;
nas_address=10.1.1.2; nas_save_p=1; nas_p= YWRtaW5UMG1iJTI0dDBuMw==;
nas_tree_x=240; nas_tree_y=370
YWRtaW5UMG1iJTI0dDBuMw== decodes to admin123qweasd

Solution.
No vendor solution.

Discovered by.
Nadeem Salim and Phil Taylor from Sense of Security Labs.

About us.
Sense of Security is a leading provider of information security and
risk management solutions. Our team has expert skills in assessment
and assurance, strategy and architecture, and deployment through to
ongoing management. We are Australia's premier application penetration
testing firm and trusted IT security advisor to many of the country's
largest organisations.

Sense of Security Pty Ltd
Level 8, 66 King St
Sydney NSW 2000
AUSTRALIA

T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au/consulting/penetration-testing
E: info@senseofsecurity.com.au
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-12-006.pdf

Other Sense of Security advisories can be found at:
http://www.senseofsecurity.com.au/research/it-security-advisories.php

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

September 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    1 Files
  • 2
    Sep 2nd
    38 Files
  • 3
    Sep 3rd
    30 Files
  • 4
    Sep 4th
    15 Files
  • 5
    Sep 5th
    12 Files
  • 6
    Sep 6th
    17 Files
  • 7
    Sep 7th
    3 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    24 Files
  • 10
    Sep 10th
    22 Files
  • 11
    Sep 11th
    22 Files
  • 12
    Sep 12th
    15 Files
  • 13
    Sep 13th
    5 Files
  • 14
    Sep 14th
    2 Files
  • 15
    Sep 15th
    1 Files
  • 16
    Sep 16th
    11 Files
  • 17
    Sep 17th
    16 Files
  • 18
    Sep 18th
    8 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close