CVE-2018-0707
published 2018-07-17CVE-2018-0707: Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run…
PriorityP265high7.2CVSS 3.0
AVNACLPRHUINSUCHIHAH
EXPLOIT
EPSS
59.21%
99.0th percentile
Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| qnap | q_center | <= 1.7.1063 | — |
| qnap | q_center_virtual_appliance | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Detect exploitation attempts by monitoring for POST requests to the change_passwd API endpoint with a new_password field containing base64-encoded shell metacharacters (e.g. decoded value starts with '"' or contains ';'). ↗
- →Alert on POST requests to /qcenter/hawkeye/v1/account?change_passwd where the new_password JSON field, when base64-decoded, contains shell injection characters such as semicolons or double-quotes. ↗
- →Monitor for GET requests to /qcenter/hawkeye/v1/account by non-admin users (ROLE != 4294967295), which indicates exploitation of the password disclosure issue (CVE-2018-0706) used as a precursor to CVE-2018-0707. ↗
- →Look for the 'new_password' field in JSON responses from /qcenter/hawkeye/v1/account containing a base64-encoded value (admin install-time password disclosure). ↗
- →The Metasploit module uses CmdStagerFlavor of printf, bourne, or wget to stage payloads; monitor for these patterns in HTTP POST bodies to the change_passwd endpoint. ↗
- →Check for creation of files under /tmp/ (e.g. /tmp/changepass) as an indicator of successful command injection via the change_passwd endpoint. ↗
- ·Exploitation requires valid credentials for the 'admin' user account, but a separate password disclosure bug (CVE-2018-0706) allows any authenticated user to retrieve the admin password set at install time, effectively lowering the bar to unauthenticated-equivalent access. ↗
- ·The vulnerability is fixed in Q'Center Virtual Appliance version 1.7.1083 and later; versions 1.6.1056 and 1.6.1075 are confirmed vulnerable. ↗
- ·The injection point is the new_password field in the change_passwd API call; the value is base64-encoded before transmission, so network-layer filters inspecting raw POST bodies will not see plaintext shell metacharacters. ↗
- ·The module targets HTTPS (port 443) by default; SSL inspection is required to inspect the POST body for injection payloads. ↗
CVSS provenance
nvdv3.07.2HIGHCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
QNAP Q'Center - 'change_passwd' Command Execution (Metasploit)
exploitdb·2018-07-17
CVE-2018-0707 QNAP Q'Center - 'change_passwd' Command Execution (Metasploit)
QNAP Q'Center - 'change_passwd' Command Execution (Metasploit)
---
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule "QNAP Q'Center change_passwd Command Execution",
'Description' => %q{
This module exploits a command injection vulnerability in the
`change_passwd` API method within the web interface of QNAP Q'Center
virtual appliance versions prior to 1.7.1083.
The vulnerability allows the 'admin' privileged user account to
execute arbitrary commands as the 'admin' operating system user.
Valid credentials for the 'admin' user account are required, however,
this module also exploits a separate password disclosure issue which
allows any authenticated user to view the password s
Exploit-DB
QNAP Qcenter Virtual Appliance - Multiple Vulnerabilities
exploitdb·2018-07-13·CVSS 8.8
CVE-2018-0710 [HIGH] QNAP Qcenter Virtual Appliance - Multiple Vulnerabilities
QNAP Qcenter Virtual Appliance - Multiple Vulnerabilities
---
Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/
QNAP Qcenter Virtual Appliance Multiple Vulnerabilities
1. *Advisory Information*
Title: QNAP Qcenter Virtual Appliance Multiple Vulnerabilities
Advisory ID: CORE-2018-0006
Advisory URL:
http://www.coresecurity.com/advisories/qnap-qcenter-multiple-vulnerabilities
Date published: 2018-07-11
Date of last update: 2018-07-11
Vendors contacted: QNAP
Release mode: Coordinated release
2. *Vulnerability Information*
Class: Information Exposure [CWE-200], Command Injection [CWE-77],
Command Injection [CWE-77], Command Injection [CWE-77],
Command Injection [CWE-77]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: Yes
CVE Name: CVE-2018-0706, CV
Metasploit
QNAP Q'Center change_passwd Command Execution
metasploit
QNAP Q'Center change_passwd Command Execution
QNAP Q'Center change_passwd Command Execution
This module exploits a command injection vulnerability in the `change_passwd` API method within the web interface of QNAP Q'Center virtual appliance versions prior to 1.7.1083. The vulnerability allows the 'admin' privileged user account to execute arbitrary commands as the 'admin' operating system user. Valid credentials for the 'admin' user account are required, however, this module also exploits a separate password disclosure issue which allows any authenticated user to view the password set for the 'admin' user during first install. This module has been tested successfully on QNAP Q'Center appliance version 1.6.1075.
No writeups or analysis indexed.
http://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.htmlhttp://seclists.org/fulldisclosure/2018/Jul/45https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilitieshttps://www.exploit-db.com/exploits/45015/https://www.exploit-db.com/exploits/45043/https://www.qnap.com/zh-tw/security-advisory/nas-201807-10https://www.securityfocus.com/archive/1/542141/100/0/threadedhttp://packetstormsecurity.com/files/148515/QNAP-Qcenter-Virtual-Appliance-1.6.x-Information-Disclosure-Command-Injection.htmlhttp://seclists.org/fulldisclosure/2018/Jul/45https://www.coresecurity.com/advisories/qnap-qcenter-virtual-appliance-multiple-vulnerabilitieshttps://www.exploit-db.com/exploits/45015/https://www.exploit-db.com/exploits/45043/https://www.qnap.com/zh-tw/security-advisory/nas-201807-10https://www.securityfocus.com/archive/1/542141/100/0/threaded
2018-07-17
Published