Vulnerability-Lookup

CERTFR-2021-AVI-397

Vulnerability from certfr_avis - Published: - Updated:

Une vulnérabilité a été découverte dans les produits QNAP. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Qnap	QuTS hero	QuTS hero versions h4.5.2.x antérieures à h4.5.2.1638 Build 20210414
Qnap	QTS	QTS versions 4.3.3.x antérieures à 4.3.3.1624 Build 20210416
Qnap	QTS	QTS versions 4.3.6.x antérieures à 4.3.6.1663 Build 20210504
Qnap	QTS	QTS versions 4.5.2.x antérieures à 4.5.2.1630 Build 20210406

References

Title

Publication Time

CVE-2021-28798 (GCVE-0-2021-28798)

Vulnerability from cvelistv5 – Published: 2021-05-21 03:00 – Updated: 2024-09-16 18:49

Title

Relative Path Traversal Vulnerability in QTS and QuTS hero

Summary

A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to modify files that impact system integrity. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.2.1630 Build 20210406 and later QTS 4.3.6.1663 Build 20210504 and later QTS 4.3.3.1624 Build 20210416 and later QuTS hero h4.5.2.1638 Build 20210414 and later QNAP NAS running QTS 4.5.3 are not affected.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-284 - Improper Access Control
CWE-23 - Relative Path Traversal

Assigner

qnap mitre root

References

1 reference

URL	Tags
https://www.qnap.com/zh-tw/security-advisory/qsa-21-14	x_refsource_MISC

Impacted products

2 products

Vendor	Product	Version
QNAP Systems Inc.	QTS	Affected: unspecified , < 4.5.2.1630 Build 20210406 (custom) Affected: unspecified , < 4.3.6.1663 Build 20210504 (custom) Affected: unspecified , < 4.3.3.1624 Build 20210416 (custom) Unaffected: 4.5.3
QNAP Systems Inc.	QuTS hero	Affected: unspecified , < h4.5.2.1638 Build 20210414 (custom)

Date Public

2021-05-21 00:00

Credits

ZUSO ART

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T21:55:11.646Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-21-14"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "QTS",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "4.5.2.1630 Build 20210406",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.6.1663 Build 20210504",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "4.3.3.1624 Build 20210416",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "4.5.3"
            }
          ]
        },
        {
          "product": "QuTS hero",
          "vendor": "QNAP Systems Inc.",
          "versions": [
            {
              "lessThan": "h4.5.2.1638 Build 20210414",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "ZUSO ART"
        }
      ],
      "datePublic": "2021-05-21T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to modify files that impact system integrity. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.2.1630 Build 20210406 and later QTS 4.3.6.1663 Build 20210504 and later QTS 4.3.3.1624 Build 20210416 and later QuTS hero h4.5.2.1638 Build 20210414 and later QNAP NAS running QTS 4.5.3 are not affected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-284",
              "description": "CWE-284 Improper Access Control",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-23",
              "description": "CWE-23 Relative Path Traversal",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-21T03:00:11.000Z",
        "orgId": "2fd009eb-170a-4625-932b-17a53af1051f",
        "shortName": "qnap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-21-14"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "QNAP have already fixed this vulnerability in the following versions:\n\nQTS 4.5.2.1630 Build 20210406 and later\nQTS 4.3.6.1663 Build 20210504 and later\nQTS 4.3.3.1624 Build 20210416 and later\nQuTS hero h4.5.2.1638 Build 20210414 and later"
        }
      ],
      "source": {
        "advisory": "QSA-21-14",
        "discovery": "EXTERNAL"
      },
      "title": "Relative Path Traversal Vulnerability in QTS and QuTS hero",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@qnap.com",
          "DATE_PUBLIC": "2021-05-21T01:07:00.000Z",
          "ID": "CVE-2021-28798",
          "STATE": "PUBLIC",
          "TITLE": "Relative Path Traversal Vulnerability in QTS and QuTS hero"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "QTS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "4.5.2.1630 Build 20210406"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "4.3.6.1663 Build 20210504"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "4.3.3.1624 Build 20210416"
                          },
                          {
                            "version_affected": "!",
                            "version_value": "4.5.3"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "QuTS hero",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "h4.5.2.1638 Build 20210414"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "QNAP Systems Inc."
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "ZUSO ART"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A relative path traversal vulnerability has been reported to affect QNAP NAS running QTS and QuTS hero. If exploited, this vulnerability allows attackers to modify files that impact system integrity. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.2.1630 Build 20210406 and later QTS 4.3.6.1663 Build 20210504 and later QTS 4.3.3.1624 Build 20210416 and later QuTS hero h4.5.2.1638 Build 20210414 and later QNAP NAS running QTS 4.5.3 are not affected."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-284 Improper Access Control"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-23 Relative Path Traversal"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qnap.com/zh-tw/security-advisory/qsa-21-14",
              "refsource": "MISC",
              "url": "https://www.qnap.com/zh-tw/security-advisory/qsa-21-14"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "QNAP have already fixed this vulnerability in the following versions:\n\nQTS 4.5.2.1630 Build 20210406 and later\nQTS 4.3.6.1663 Build 20210504 and later\nQTS 4.3.3.1624 Build 20210416 and later\nQuTS hero h4.5.2.1638 Build 20210414 and later"
          }
        ],
        "source": {
          "advisory": "QSA-21-14",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2fd009eb-170a-4625-932b-17a53af1051f",
    "assignerShortName": "qnap",
    "cveId": "CVE-2021-28798",
    "datePublished": "2021-05-21T03:00:11.671Z",
    "dateReserved": "2021-03-18T00:00:00.000Z",
    "dateUpdated": "2024-09-16T18:49:25.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.