In this Section

Sense of Security – Security Advisory – SOS-12-006 – QNAP Turbo NAS Multiple Vulnerabilities

pdf_symbol

Sense of Security – Security Advisory – SOS-12-006

Release Date. 13-Jun-2012
Last Update.
Vendor Notification Date. 13-Mar-2012
Product. QNAP
Platform. Turbo NAS (verified) and possibly others
Affected versions. Firmware Version: 3.6.1 Build 0302T and prior
Severity Rating. High
Impact. Exposure of sensitive information
Exposure of system information
Privilege escalation
System access
Attack Vector. Remote with authentication
Solution Status. Currently no software update, vendor has elected not to fix at this time
CVE reference. CVE- Not yet assigned

 

Details.

QNAP provide NAS technology solutions to consumers and enterprises.

Multiple vulnerabilities have been identified in the web management

interface.

 

1. Command Injection:

The QNAP Download Station (QDownload) is vulnerable to command injection

as the application executes user-controllable data that is processed by

a shell command interpreter.

 

The following resources, accessible post authentication are affected:

/cgi-bin/Qdownload/DS_RSS_Option.cgi [keyword parameter]

/cgi-bin/Qdownload/DS_RSS_Option.cgi [title parameter]

Commands are executed with the context of the admin user [uid=0(admin)

gid=0(administrators] on the QNAP device.

 

Proof of Concept.

/cgi-bin/Qdownload/DS_RSS_Option.cgi?_dc=1331164660690&url=http%3A%2F%2

Fgoogle.com&title=test&keyword=`touch%20%2ftesto%2e

txt`&todo=add&sid=i9nonapr&ver=2.0
2. Cryptography:

The QNAP login page stores persistent cookies (including the administrator

username and password) as base64 encoded strings inside the cookie

parameter nas_p. These cookies are not protected with either the HTTPOnly

or Secure flags allowing theft via one of the many cross-site scripting

vulnerabilities which exist within the application (disclosed previously

by another researcher, but never fixed).

 

Proof of Concept.

Cookie: qnap_admin_style=default; nas_save_u=1; nas_u=bGFicw==;

nas_address=10.1.1.2; nas_save_p=1; nas_p= YWRtaW5UMG1iJTI0dDBuMw==;

nas_tree_x=240; nas_tree_y=370

YWRtaW5UMG1iJTI0dDBuMw== decodes to admin123qweasd

 

Solution.

No vendor solution.

 

Discovered by.

Nadeem Salim and Phil Taylor from Sense of Security Labs.