网站地图    收藏   

主页 > 后端 > 网站安全 >

QNAP Turbo NAS 3.6.1 Build 0302T多个缺陷及修复 - 网站安

来源:自学PHP网    时间:2015-04-17 13:02 作者: 阅读:

[导读] 影响产品 QNAP平台 Turbo NAS (verified) and possibly others受影响版本. Firmware Version: 3.6.1 Build 0302T and priorSeverity Rating. HighImpact. Exposure of sensitive informat......

影响产品    QNAP 
 
平台    Turbo NAS (verified) and possibly others 
 
受影响版本.         Firmware Version: 3.6.1 Build 0302T and prior 
 
Severity Rating.           High 
 
Impact.                    Exposure of sensitive information 
 
                           Exposure of system information 
 
                           Privilege escalation 
 
                           System access 
 
Attack Vector.             Remote with authentication 
 
解决方案.    官方尚未升级 
技术分析

QNAP provide NAS technology solutions to consumers and enterprises. 
 
Multiple vulnerabilities have been identified in the web management  
 
interface. 
 
  
 
1. 命令注入
 
The QNAP Download Station (QDownload) is vulnerable to command injection  
 
as the application executes user-controllable data that is processed by  
 
a shell command interpreter. 
 
  
 
The following resources, accessible post authentication are affected: 
 
www.2cto.com /cgi-bin/Qdownload/DS_RSS_Option.cgi [keyword parameter] 
 
/cgi-bin/Qdownload/DS_RSS_Option.cgi [title parameter] 
 
Commands are executed with the context of the admin user [uid=0(admin)  
 
gid=0(administrators] on the QNAP device. 
 
  测试证明 
 
/cgi-bin/Qdownload/DS_RSS_Option.cgi?_dc=1331164660690&url=http%3A%2F%2F 
 
google.com&title=test&keyword=`touch%20%2ftesto%2etxt`&todo=add&sid=i9 
 
nonapr&ver=2.0 
 
  
 
2. 密码 
 
The QNAP login page stores persistent cookies (including the administrator  
 
username and password) as base64 encoded strings inside the cookie  
 
parameter nas_p. These cookies are not protected with either the HTTPOnly  
 
or Secure flags allowing theft via one of the many cross-site scripting  
 
vulnerabilities which exist within the application (disclosed previously  
 
by another researcher, but never fixed). 
 
  
 
测试证明. 
 
Cookie: qnap_admin_style=default; nas_save_u=1; nas_u=bGFicw==;  
 
nas_address=10.1.1.2; nas_save_p=1; nas_p= YWRtaW5UMG1iJTI0dDBuMw==;  
 
nas_tree_x=240; nas_tree_y=370 
 
YWRtaW5UMG1iJTI0dDBuMw== decodes to admin123qweasd 
 
   Discovered by. 
 
Nadeem Salim and Phil Taylor from Sense of Security Labs. 
 
  关注这类获取更新
 
http://www.senseofsecurity.com.au/advisories/SOS-12-006.pdf 
 
  
 
Other Sense of Security advisories can be found at: 
 
http://www.senseofsecurity.com.au/research/it-security-advisories.php

自学PHP网专注网站建设学习,PHP程序学习,平面设计学习,以及操作系统学习

京ICP备14009008号-1@版权所有www.zixuephp.com

网站声明:本站所有视频,教程都由网友上传,站长收集和分享给大家学习使用,如由牵扯版权问题请联系站长邮箱904561283@qq.com

添加评论