CVE-2018-0706
published 2018-07-17CVE-2018-0706: Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information.
PriorityP268high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EXPLOIT
EPSS
48.69%
98.7th percentile
Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| qnap | q_center | <= 1.7.1063 | — |
| qnap | q_center_virtual_appliance | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor HTTP GET requests to /qcenter/hawkeye/v1/account from non-admin authenticated sessions; the presence of a 'new_password' field in the JSON response indicates the password disclosure vulnerability (CVE-2018-0706) is being triggered. ↗
- →Detect POST requests to /qcenter/hawkeye/v1/account?change_passwd where the new_password JSON field contains base64-encoded strings that decode to shell metacharacters (e.g., semicolons, quotes) indicative of command injection. ↗
- →Alert on POST requests to /qcenter/hawkeye/v1/network_config or /qcenter/hawkeye/v1/date_config where the 'passwd' field contains base64 data that decodes to shell injection payloads (e.g., semicolons, touch/echo commands). ↗
- →Inspect session cookies for ROLE values corresponding to low-privilege accounts (e.g., ROLE=1082130432 for viewer, ROLE=1610612735 for power user) making requests to privileged API endpoints like /hawkeye/v1/account, which should be restricted to admin. ↗
- →Check for the _ID cookie value being scanned/extracted from session cookies, as the exploit uses it to identify the admin account _id for the change_passwd injection. ↗
- →Version fingerprinting: Q'Center versions prior to 1.7.1083 are vulnerable; detect version strings in HTTP responses via the pattern `.js?_v=<version>` in the index.html body. ↗
- ·CVE-2018-0706 (password disclosure) is chained with CVE-2018-0707 (command injection via change_passwd) in the Metasploit module; the two CVEs are distinct but used together in exploitation. ↗
- ·The exploit requires valid credentials for at least one authenticated user (not necessarily admin); any authenticated user can exploit CVE-2018-0706 to retrieve the admin password. ↗
- ·The admin password is only the one set at installation time; if the admin password was changed post-install, the new_password field may not reflect the current password. ↗
- ·The module targets HTTPS (port 443) by default; detections should account for TLS-encrypted traffic requiring SSL inspection. ↗
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
QNAP Q'Center - 'change_passwd' Command Execution (Metasploit)
exploitdb·2018-07-17
CVE-2018-0707 QNAP Q'Center - 'change_passwd' Command Execution (Metasploit)
QNAP Q'Center - 'change_passwd' Command Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule "QNAP Q'Center change_passwd Command Execution",
'Description' => %q{
This module exploits a command injection vulnerability in the
`change_passwd` API method within the web interface of QNAP Q'Center
virtual appliance versions prior to 1.7.1083.
The vulnerability allows the 'admin' privileged user account to
execute arbitrary commands as the 'admin' operating system user.
Valid credentials for the 'admin' user account are required, however,
this module also exploits a separate password disclosure issue which
allows any authenticated user to view the password s
Exploit-DB
QNAP Qcenter Virtual Appliance - Multiple Vulnerabilities
exploitdb·2018-07-13·CVSS 8.8
CVE-2018-0710 [HIGH] QNAP Qcenter Virtual Appliance - Multiple Vulnerabilities
QNAP Qcenter Virtual Appliance - Multiple Vulnerabilities
---
Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/
QNAP Qcenter Virtual Appliance Multiple Vulnerabilities
1. *Advisory Information*
Title: QNAP Qcenter Virtual Appliance Multiple Vulnerabilities
Advisory ID: CORE-2018-0006
Advisory URL:
http://www.coresecurity.com/advisories/qnap-qcenter-multiple-vulnerabilities
Date published: 2018-07-11
Date of last update: 2018-07-11
Vendors contacted: QNAP
Release mode: Coordinated release
2. *Vulnerability Information*
Class: Information Exposure [CWE-200], Command Injection [CWE-77],
Command Injection [CWE-77], Command Injection [CWE-77],
Command Injection [CWE-77]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: Yes
CVE Name: CVE-2018-0706, CV
Metasploit
QNAP Q'Center change_passwd Command Execution
metasploit
QNAP Q'Center change_passwd Command Execution
QNAP Q'Center change_passwd Command Execution
This module exploits a command injection vulnerability in the `change_passwd` API method within the web interface of QNAP Q'Center virtual appliance versions prior to 1.7.1083. The vulnerability allows the 'admin' privileged user account to execute arbitrary commands as the 'admin' operating system user. Valid credentials for the 'admin' user account are required, however, this module also exploits a separate password disclosure issue which allows any authenticated user to view the password set for the 'admin' user during first install. This module has been tested successfully on QNAP Q'Center appliance version 1.6.1075.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.htmlhttp://seclists.org/fulldisclosure/2018/Jul/45https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilitieshttps://www.exploit-db.com/exploits/45015/https://www.exploit-db.com/exploits/45043/https://www.qnap.com/zh-tw/security-advisory/nas-201807-10https://www.securityfocus.com/archive/1/542141/100/0/threadedhttp://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.htmlhttp://seclists.org/fulldisclosure/2018/Jul/45https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilitieshttps://www.exploit-db.com/exploits/45015/https://www.exploit-db.com/exploits/45043/https://www.qnap.com/zh-tw/security-advisory/nas-201807-10https://www.securityfocus.com/archive/1/542141/100/0/threaded
2018-07-17
Published