Understanding the QNAP QTS Zero-Day Vulnerability - Cyber and Fraud Centre

Introduction

In May 2024, cyber security researchers uncovered a significant vulnerability within QNAP’s QTS operating system, a critical software powering the company’s NAS (Network Attached Storage) devices. This vulnerability, known as CVE-2024-27130, poses a serious threat to users due to its potential for remote code execution (RCE).

Background on the QNAP QTS Zero-Day Vulnerability

The QNAP QTS operating system is widely used in NAS devices, which are essential for data storage and sharing in both small businesses and large enterprises. These devices are attractive targets for cybercriminals because they often store sensitive and valuable data.

In a thorough security audit conducted by WatchTowr Labs, 15 vulnerabilities of varying severity were identified within QTS. Among these, CVE-2024-27130 stood out due to its potential for remote code execution. This particular vulnerability is rooted in a stack buffer overflow within the ‘No_Support_ACL’ function of the ‘share.cgi’ script. Exploiting this flaw allows attackers to execute arbitrary code on the affected device, potentially leading to full system compromise.

How the Vulnerability is Exploited

To exploit CVE-2024-27130, attackers need to obtain a valid ‘ssid’ parameter, which is generated when a NAS user shares a file. This parameter is often included in the URL of the shared link. Once the ‘ssid’ is acquired, the attacker can craft a malicious request with a specially crafted ‘name’ parameter that causes a buffer overflow, resulting in remote code execution.

While obtaining the ‘ssid’ requires some degree of social engineering or access to shared links, these links are sometimes publicly accessible or indexed by search engines, making it easier for attackers to find them.

Tactics, Techniques, and Procedures (TTP)

Reconnaissance: Attackers search for publicly accessible or shared ‘ssid’ parameters using search engines or by targeting known NAS users.
Social Engineering: Attackers may trick users into sharing files, thereby obtaining the ‘ssid’ parameter.
Exploitation: Once the ‘ssid’ is obtained, attackers craft a malicious request that triggers the buffer overflow and allows code execution.
Post-Exploitation: Attackers gain control over the NAS device, potentially creating new user accounts with elevated privileges or installing malicious software to maintain access.

Preventing Exploitation

To mitigate the risk posed by this and similar vulnerabilities, users should take several precautions:

Update Software Regularly: Ensure that the NAS device’s firmware and software are up to date. QNAP has released patches for some vulnerabilities, and keeping your system updated is crucial.
Limit Public Sharing: Avoid sharing links publicly or ensure that shared links are protected with strong passwords and set to expire after a short period.
Network Segmentation: Segment NAS devices from the rest of the network to limit potential damage if a device is compromised.
Monitor for Suspicious Activity: Implement robust monitoring and logging to detect unusual activity that might indicate an exploitation attempt.

Responding to an Exploitation

If you suspect that your NAS device has been compromised, follow these steps:

Disconnect the Device: Immediately disconnect the affected device from the network to prevent further exploitation.
Assess the Damage: Conduct a thorough assessment to determine the extent of the compromise and identify any unauthorised changes or installations.
Restore from Backup: If possible, restore the device to a pre-compromise state using known good backups.
Patch and Update: Ensure that all vulnerabilities are patched, and the system is updated to the latest firmware version.
Strengthen Security Measures: Review and enhance your security measures to prevent future incidents, including revising user access policies and improving network segmentation.

The discovery of the QNAP QTS zero-day vulnerability highlights the importance of vigilance in cyber security. By understanding how such vulnerabilities can be exploited and implementing robust preventive measures, users can significantly reduce the risk of becoming victims. Regular updates, cautious sharing practices, and strong security protocols are essential in safeguarding valuable data stored on NAS devices. If a compromise does occur, prompt action and thorough investigation can mitigate the impact and prevent further damage.

For more detailed technical insights and proof of concept (PoC) exploit demonstrations, refer to the original sources from WatchTowr Labs and BleepingComputer:

21.05.24

Threat Intelligence Alerts