SB2019012809 - Multiple vulnerabilities in QNAP QTS

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Command Injection (CVE-ID: CVE-2018-19949)

The vulnerability allows a remote user to execute arbitrary commands on the system.

The vulnerability exists due to insufficient input validation in username on proper authentication after account creation. A remote administrator can create users with usernames containing bash syntax that evaluates code and execute arbitrary commands on the system.

2) Stored cross-site scripting (CVE-ID: CVE-2018-19953)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in user description. A remote attacker can inject link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

3) Stored cross-site scripting (CVE-ID: CVE-2018-19943)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in File Station. A remote attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

Install update from vendor's website.

References

• https://www.qnap.com/en/release-notes/qts/4.4.1.1216/20200214
• https://blog.securityevaluators.com/multiple-vulnerabilities-discovered-in-qnap-nass-303b720d487b