unit42.paloaltonetworks.com
Open in
urlscan Pro
95.100.64.105
Public Scan
URL:
https://unit42.paloaltonetworks.com/qnap-qts-firmware-cve-2023-50358/
Submission: On February 14 via api from TR — Scanned from CH
Submission: On February 14 via api from TR — Scanned from CH
Form analysis 2 forms found in the DOM
Name: Unit42_Subscribe — POST https://www.paloaltonetworks.com/apps/pan/public/formsubmithandler.submitform.json
<form action="https://www.paloaltonetworks.com/apps/pan/public/formsubmithandler.submitform.json" method="post" novalidate="" class="subscribe-form py-25" name="Unit42_Subscribe">
<input type="hidden" name="emailFormMask" value="">
<input type="hidden" value="1086" name="formid">
<!-- <input type="hidden" value="818-CZC-273" name="munchkinId"> -->
<input type="hidden" value="531-OCS-018" name="munchkinId">
<input type="hidden" value="2141" name="lpId">
<input type="hidden" value="1203" name="programId">
<input type="hidden" value="1086" name="formVid">
<input type="hidden" name="mkto_optinunit42" value="true">
<input type="hidden" name="mkto_opt-in" value="true">
<div class="row">
<div class="col-sm col-12 mb-sm-0 mb-15">
<input type="email" name="Email" placeholder="Email address" class="subscribe-field d-block w-100 px-sm-25 px-15 bg-white" aria-label="Email">
<p class="error-mail d-none mt-15 text-danger" style="color: #dc3545">Please enter your email address!</p>
</div>
<div class="col-sm-auto col-12">
<input type="submit" value="Subscribe" class="btn btn--black btn--sm w-100" disabled="disabled">
</div>
</div>
<div class="google-recapth mt-15">
<div class="g-recaptcha" data-expired-callback="captchaExpires" data-callback="captchaComplete" data-sitekey="6Lc5EhgTAAAAAJa-DzE7EeWABasWg4LKv-R3ao6o">
<div style="width: 304px; height: 78px;">
<div><iframe title="reCAPTCHA" width="304" height="78" role="presentation" name="a-hu8rt2rtxqat" frameborder="0" scrolling="no"
sandbox="allow-forms allow-popups allow-same-origin allow-scripts allow-top-navigation allow-modals allow-popups-to-escape-sandbox allow-storage-access-by-user-activation"
src="https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc5EhgTAAAAAJa-DzE7EeWABasWg4LKv-R3ao6o&co=aHR0cHM6Ly91bml0NDIucGFsb2FsdG9uZXR3b3Jrcy5jb206NDQz&hl=de-CH&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=normal&cb=rrneidfnotm0"></iframe>
</div><textarea id="g-recaptcha-response" name="g-recaptcha-response" class="g-recaptcha-response" style="width: 250px; height: 40px; border: 1px solid rgb(193, 193, 193); margin: 10px 25px; padding: 0px; resize: none; display: none;"
aria-label="recaptcha"></textarea>
</div><iframe style="display: none;"></iframe>
</div>
<p class="error-recaptcha d-none mt-15 text-danger" style="color: #dc3545">Please mark, I'm not a robot!</p>
</div>
</form>POST
<form method="post">
<input type="hidden" id="_wpnonce" name="_wpnonce" value="2cff6147ca"><input type="hidden" name="_wp_http_referer" value="/qnap-qts-firmware-cve-2023-50358/">
</form>Text Content
Menu
* Tools
* ATOMs
* Security Consulting
* About Us
* Under Attack?
*
* About Unit 42
* Services
Services
Assess and Test Your Security Controls
* Attack Surface Assessment
* Breach Readiness Review
* BEC Readiness Assessment
* Compromise Assessment
* Cyber Risk Assessment
* M&A Cyber Due Diligence
* Penetration Testing
* Purple Team Exercises
* Ransomware Readiness Assessment
* SOC Assessment
* Supply Chain Risk Assessment
* Tabletop Exercises
* Unit 42 Retainer
Transform Your Security Strategy
* IR Plan Development and Review
* Security Program Design
* Virtual CISO
Respond in Record Time
* Cloud Incident Response
* Digital Forensics
* Incident Response
* Managed Detection and Response
* Managed Threat Hunting
* Unit 42 Retainer
UNIT 42 RETAINER
Custom-built to fit your organization's needs, you can choose to allocate
your retainer hours to any of our offerings, including proactive cyber risk
management services. Learn how you can put the world-class Unit 42 Incident
Response team on speed dial.
Learn more
* Unit 42 Threat Research
Unit 42 Threat Research
Unit 42 Threat Research
* Threat Briefs and Assessments
Details on the latest cyber threats
* Tools
Lists of public tools released by our team
* Threat Reports
Downloadable, in-depth research reports
THREAT REPORT
2022 Incident Response Report: Understand today’s attacks to prevent future
threats
Read it now
THREAT BRIEF
Russia-Ukraine Cyberattacks: How to Protect Against Related Cyberthreats
Including DDoS, HermeticWiper, Gamaredon, Website Defacement
Learn more
THREAT REPORT
Highlights from the Unit 42 Cloud Threat Report, Volume 6
Learn more
* Partners
Partners
Partners
* Threat Intelligence Sharing
* Law Firms and Insurance Providers
* Threat Intel Bulletin
THREAT REPORT
2022 Unit 42 Ransomware Threat Report: Understand trends and tactics to
bolster defenses
Learn more
THREAT BRIEF
Russia-Ukraine Cyberattacks: How to Protect Against Related Cyberthreats
Including DDoS, HermeticWiper, Gamaredon, Website Defacement
Learn more
THREAT BRIEF
Operation Falcon II: Unit 42 Helps Interpol Identify Nigerian Business Email
Compromise Ring Members
Learn more
* Resources
Resources
Resources
* Research Reports
* Webinars
* Customer Stories
* Datasheets
* Videos
* Infographics
* Whitepapers
* In the News
* Cyberpedia
Industries
* Financial Services
* Healthcare
* Manufacturing
THREAT REPORT
2023 Unit 42 Ransomware and Extortion Report: Get the latest multi-extortion
trends and insights to keep your organization protected.
Learn more
RESEARCH REPORT
Gartner Market Guide for Digital Forensics and Incident Response Services
Learn more
*
* Under Attack?
Search
All
* Tech Docs
Close search modal
NEW VULNERABILITY IN QNAP QTS FIRMWARE: CVE-2023-50358
* 804
people reacted
*
* 2
* 5 min. read
Share
By Chao Lei, Jeff Luo and Zhibin Zhang
February 13, 2024 at 3:00 AM
Category: Vulnerability
Tags: Advanced Threat Prevention, Cloud-Delivered Security Services, Cortex
Xpanse, CVE-2023-50358, IoT, IoT Security, IoT Vulnerability, next-generation
firewall, QNAP Network Attached Storage
This post is also available in: 日本語 (Japanese)
EXECUTIVE SUMMARY
This article provides technical analysis on a zero-day vulnerability affecting
QNAP Network Attached Storage (NAS) devices. Our Advanced Threat Prevention
(ATP) and telemetry systems provided indicators of a previously unknown
vulnerability in QNAP QTS and QuTS hero firmware. We provided our findings to
the vendor, and QNAP has assigned the tracking ID CVE-2023-50358 to this new
vulnerability. We also offer recommendations on how to defend against this
newly-revealed threat.
QNAP is an acronym for Quality Network Appliance Provider. This acronym is the
name for a company that specializes in various products, including operating
systems for NAS devices. One such operating system is the QNAP Turbo NAS System
(QTS). This QTS code is often embedded in the firmware of QNAP NAS devices.
Threat actors continuously probe for vulnerabilities in network-connected hosts
like NAS devices. When threat actors discover a new vulnerability, they can be
quick to exploit it. Unit 42 researchers at Palo Alto Networks constantly
monitor our telemetry to reveal these types of attacks.
QNAP has released a new security advisory, with acknowledgment to Palo Alto
Networks, that provides guidance and recommended actions on the newly discovered
vulnerability. We recommend any affected organizations follow QNAP's guidance to
address this new threat by following the mitigation instructions or applying the
associated firmware updates.
Palo Alto Networks Advanced Threat Prevention possesses the capability to detect
exploitation of unknown vulnerabilities. This functionality is what helped us to
discover this zero-day attack.
Palo Alto Networks Next-Generation Firewall customers are better protected
through Cloud-Delivered Security Service subscriptions, including Internet of
Things (IoT) security and Advanced Threat Prevention, which can detect and block
exploit traffic. Cortex Xpanse can also provide customer visibility into
externally exposed QNAP devices. If you think you might have been compromised or
have an urgent matter, contact the Unit 42 Incident Response team.
Related Unit 42 Topics IoT, CVE-2023-50358
TABLE OF CONTENTS
New Vulnerability in QNAP QTS Firmware: CVE-2023-50358
Executive Summary
Table of Contents
Vulnerability Overview
Impact of CVE-2023-50358
Conclusion
Palo Alto Networks Protections
VULNERABILITY OVERVIEW
The command injection vulnerability exists in the quick.cgi component of QNAP
QTS firmware, which can be accessed without authentication.
While setting the HTTP request parameter todo=set_timeinfo, the request handler
in quick.cgi saves the value of the parameter SPECIFIC_SERVER into a
configuration file /tmp/quick/quick_tmp.conf with the entry name NTP Address, as
depicted in Figure 1.
Figure 1. Quick.cgi writes user input into the configuration file.
After writing the NTP server address, the component starts time synchronization
using the ntpdate utility. The command-line execution is built by reading the
NTP Address in quick_tmp.conf, and this string is then executed using system(),
as depicted in Figure 2.
Figure 2. Quick.cgi command execution.
Untrusted data from the SPECIFIC_SERVER parameter is therefore used to build a
command line to be executed in the shell resulting in arbitrary command
execution, as depicted in Figure 3.
Figure 3. Proof of command-line execution.
IMPACT OF CVE-2023-50358
Figure 4 represents Xpanse data on vulnerable NAS devices detected from our
telemetry during a 1 week period in mid-January 2024. In this timespan, we
detected vulnerable devices from 289,665 separate IP addresses. Figure 4 shows a
global heat map of the countries most affected by this vulnerability, and it
lists the top 18 nations these IP addresses are registered to.
Figure 4. Global heatmap and list showing the countries most affected by this
vulnerability.
CONCLUSION
The disclosure timeline is as follows:
* On Nov. 7, 2023, Unit 42 researchers were alerted of suspicious attack
traffic targeted at QNAP devices by the Advanced Threat Prevention platform.
Further analysis revealed a new vulnerability related to (but not directly
exploited by) the observed traffic.
* A detailed vulnerability analysis was provided to the vendor on Nov. 21,
2023.
* The vendor confirmed the vulnerability on Dec. 19, 2023.
* Vendor has released a security advisory that provides guidance and
recommendations.
These remote code execution vulnerabilities affecting IoT devices exhibit a
combination of low attack complexity and critical impact, making them an
irresistible target for threat actors. As a result, protecting IoT devices
against such threats is an urgent task.
To mitigate the vulnerability, QNAP recommends updating to the latest version of
QTS or QuTScloud hero (e.g., QTS 5.1.5 or QuTS hero h5.1.5). If updating the
operating system to the latest version is not an option, users can perform the
following actions to mitigate the vulnerability.
* Test the following URL in your browser:
* https://<NAS IP address>:<NAS system port>/cgi-bin/quick/quick.cgi
* If you get the following response (HTTP 404 error), your system is not
vulnerable:
* "Page not found or the web server is currently unavailable. Please contact
the website administrator for help."
* If you get an empty page (HTTP 200), continue to the next step.
* Update your operating system to one of the following versions or later:
* QTS 5.0.0.1986 build 20220324 or later
* QTS 4.5.4.2012 build 20220419 or later
* QuTS h5.0.0.1986 build 20220324 or later
* QuTS h4.5.4.1991 build 20220330 or later
* Test the above URL again in your browser.
* If you get the following response (HTTP 404 error), your system is now free
from the vulnerability:
* "Page not found or the web server is currently unavailable. Please contact
the website administrator for help."
* If you get an empty page (HTTP 200), please contact QNAP technical support
for assistance.
PALO ALTO NETWORKS PROTECTIONS
Palo Alto Networks customers are better protected against the vulnerabilities
and malware discussed in this article through the following products and
services:
* Next-Generation Firewall with a Threat Prevention or Advanced Threat
Prevention security subscription can block attacks with Best Practices via
Threat Prevention signature 94969.
* Advanced Threat Prevention has a built-in machine learning-based security
detection that can detect exploit traffic inline and in real time.
* The Palo Alto Networks IoT security platform can leverage network traffic
information to identify the vendor, model and firmware version of a device
and identify specific devices that are affected by this vulnerability.
* In addition, IoT Security has an inbuilt machine learning-based anomaly
detection that can alert the customer if a device exhibits nontypical
behavior, such as the following:
* The sudden appearance of traffic from a new source
* An unusually high number of connections
* An inexplicable surge of certain attributes typically appearing in IoT
application payloads
* Cortex Xpanse can detect QNAP NAS devices exposed to the external internet to
give defenders an inventory of all potentially vulnerable devices.
If you think you might have been compromised or have an urgent matter, contact
the Unit 42 Incident Response team or call:
* North America Toll-Free: 866.486.4842 (866.4.UNIT42)
* EMEA: +31.20.299.3130
* APAC: +65.6983.8730
* Japan: +81.50.1790.0200
Palo Alto Networks has shared our findings with our fellow Cyber Threat Alliance
(CTA) members. CTA members use this intelligence to rapidly deploy protections
to their customers and to systematically disrupt malicious cyber actors. Learn
more about the Cyber Threat Alliance.
GET UPDATES FROM
PALO ALTO
NETWORKS!
Sign up to receive the latest news, cyber threat intelligence and research from
us
Please enter your email address!
Please mark, I'm not a robot!
By submitting this form, you agree to our Terms of Use and acknowledge our
Privacy Statement.
POPULAR RESOURCES
* Resource Center
* Blog
* Communities
* Tech Docs
* Unit 42
* Sitemap
LEGAL NOTICES
* Privacy
* Terms of Use
* Documents
ACCOUNT
* Manage Subscriptions
*
* Report a Vulnerability
© 2024 Palo Alto Networks, Inc. All rights reserved.
This site uses cookies essential to its operation, for analytics, and for
personalized content and ads. Please read our privacy statement for more
information.Privacy statement
Cookies Settings Reject All Accept All
Your Opt Out Preference Signal is Honored
PRIVACY PREFERENCE CENTER
When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer.
More information on cookie consent
Allow All
MANAGE YOUR CONSENT PREFERENCES
STRICTLY NECESSARY COOKIES
Always Active
These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms. You can set your browser to
block or alert you about these cookies, but some parts of the site will not then
work. These cookies do not store any personally identifiable information.
PERFORMANCE COOKIES
Performance Cookies
These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site. All
information these cookies collect is aggregated and therefore anonymous. If you
do not allow these cookies we will not know when you have visited our site, and
will not be able to monitor its performance.
FUNCTIONAL COOKIES
Functional Cookies
These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages. If you do not allow these cookies then
some or all of these services may not function properly.
TARGETING COOKIES
Targeting Cookies
These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites. They do not store directly personal
information, but are based on uniquely identifying your browser and internet
device. If you do not allow these cookies, you will experience less targeted
advertising.
Back Button
COOKIE LIST
Search Icon
Filter Icon
Clear
checkbox label label
Apply Cancel
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label
Reject All Confirm My Choices