影响产品 QNAP 平台 Turbo NAS (verified) and possibly others 受影响版本. Firmware Version: 3.6.1 Build 0302T and prior Severity Rating. High Impact. Exposure of sensitive information Exposure of system information Privilege escalation System access Attack Vector. Remote with authentication 解决方案. 官方尚未升级 技术分析 QNAP provide NAS technology solutions to consumers and enterprises. Multiple vulnerabilities have been identified in the web management interface. 1. 命令注入 The QNAP Download Station (QDownload) is vulnerable to command injection as the application executes user-controllable data that is processed by a shell command interpreter. The following resources, accessible post authentication are affected: www.2cto.com /cgi-bin/Qdownload/DS_RSS_Option.cgi [keyword parameter] /cgi-bin/Qdownload/DS_RSS_Option.cgi [title parameter] Commands are executed with the context of the admin user [uid=0(admin) gid=0(administrators] on the QNAP device. 测试证明 /cgi-bin/Qdownload/DS_RSS_Option.cgi?_dc=1331164660690&url=http%3A%2F%2F google.com&title=test&keyword=`touch%20%2ftesto%2etxt`&todo=add&sid=i9 nonapr&ver=2.0 2. 密码 The QNAP login page stores persistent cookies (including the administrator username and password) as base64 encoded strings inside the cookie parameter nas_p. These cookies are not protected with either the HTTPOnly or Secure flags allowing theft via one of the many cross-site scripting vulnerabilities which exist within the application (disclosed previously by another researcher, but never fixed). 测试证明. Cookie: qnap_admin_style=default; nas_save_u=1; nas_u=bGFicw==; nas_address=10.1.1.2; nas_save_p=1; nas_p= YWRtaW5UMG1iJTI0dDBuMw==; nas_tree_x=240; nas_tree_y=370 YWRtaW5UMG1iJTI0dDBuMw== decodes to admin123qweasd Discovered by. Nadeem Salim and Phil Taylor from Sense of Security Labs. 关注这类获取更新 http://www.sen seo fsecurity.com.au/advisories/SOS-12-006.pdf Other Sense of Security advisories can be found at: http://www.senseofsecurity.com.au/research/it-security-advisories.php
查看更多关于QNAP Turbo NAS 3.6.1 Build 0302T多个缺陷及修复 - 网站安的详细内容...