CVE-2018-0708

published 2018-07-17

CVE-2018-0708: Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary…

Priority P2 71 high 8.8 CVSS 3.0

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
qnap	q_center	<= 1.7.1063	—
qnap	q_center_virtual_appliance	—	—

Detection & IOCs extracted from sources · hover to see the quote

url POST /qcenter/hawkeye/v1/network_config↗

url GET /qcenter/hawkeye/v1/account?_dc=1519932315271↗

url POST /qcenter/hawkeye/v1/account?change_passwd↗

url POST /qcenter/hawkeye/v1/date_config↗

cookie CMS_SID=MFVG0R9SMK; ROLE=1610612735↗

command ";touch /tmp/netconfigpower; echo "a↗

command ";touch /tmp/date_config;echo"lalala↗

other passwd=Ijt0b3VjaCAvdG1wL25ldGNvbmZpZ3Bvd2VyOyBlY2hvICJh↗

• → Monitor POST requests to /qcenter/hawkeye/v1/network_config — the `passwd` field is passed unsanitized into a bash echo/sudo command, enabling command injection via base64-encoded payloads. ↗
• → Alert on GET requests to /qcenter/hawkeye/v1/account by non-admin roles; the response leaks the admin password in the `new_password` field encoded in base64. ↗
• → Detect presence of files /tmp/netconfigpower or /tmp/date_config on the Q'center appliance filesystem as indicators of successful command injection exploitation. ↗
• → Inspect the `passwd` JSON field in POST bodies to /qcenter/hawkeye/v1/network_config and /qcenter/hawkeye/v1/date_config for base64-encoded strings that decode to shell metacharacters (e.g., semicolons, quotes). ↗
• → Flag authenticated sessions with ROLE=1610612735 (Power User) accessing /qcenter/hawkeye/v1/network_config or /qcenter/hawkeye/v1/date_config, as Power Users should not have access to these endpoints via the web UI. ↗

• · Affected versions confirmed in testing are Q'center Virtual Appliance 1.6.1056 (20170825) and 1.6.1075 (20171123); NVD lists 1.7.1063 and earlier as vulnerable — other versions may also be affected but were not tested. ↗

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78