cbcvebase.
CVE-2017-6359
published 2017-03-23

CVE-2017-6359: QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands via unspecified vectors.

PriorityP276critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
26.85%
97.8th percentile
QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and execute arbitrary commands via unspecified vectors.

Affected

1 ranges
VendorProductVersion rangeFixed in
qnapqts<= 4.2.4—

Detection & IOCsextracted from sources · hover to see the quote

path/cgi-bin/filemanager/utilRequest.cgi↗
urlhttps://TARGET/cgi-bin/filemanager/utilRequest.cgi?func=cancel_trash_recovery&sid=SIDVALUE&pid=`id>/tmp/pwned`↗
port8080↗
port443↗
  • →Monitor HTTP GET requests to /cgi-bin/filemanager/utilRequest.cgi with the 'func=cancel_trash_recovery' parameter; inspect the 'pid' parameter for shell metacharacters (backticks, semicolons, pipes, etc.) indicative of command injection. ↗
  • →The vulnerable sink is a system() call executing '/bin/kill -9 <pid>'; alert on process executions spawned from the QNAP web CGI process where the argument to kill contains non-numeric characters. ↗
  • →Exploitation requires an authenticated session (valid 'sid' cookie/parameter); correlate suspicious CGI requests with prior authentication events to identify compromised sessions. ↗
  • →Successful exploitation results in command execution as uid=0(admin); monitor for unexpected files written under /tmp/ (e.g., /tmp/pwned) by the web server process. ↗
  • ·Exploitation requires an authenticated session (valid sid value); the vulnerability is not unauthenticated/pre-auth for CVE-2017-6359 specifically. ↗
  • ·Confirmed affected firmware versions include 4.2.2 Build 20161214 and 4.2.3 Build 20170213; believed to affect all devices running QTS prior to the patch. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.