CVE-2018-0710

published 2018-07-17

CVE-2018-0710: Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary…

Priority P2 68 high 8.8 CVSS 3.0

AV N AC L PR L UI N S U C H I H A H

EXPLOIT

Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
qnap	q_center	<= 1.7.1063	—
qnap	q_center_virtual_appliance	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /qcenter/hawkeye/v1/account?_dc=1519932315271↗

url /qcenter/hawkeye/v1/account?change_passwd↗

url /qcenter/hawkeye/v1/network_config↗

url /qcenter/hawkeye/v1/date_config↗

command sudo passwd↗

command ";touch /tmp/netconfigpower; echo "a↗

command ";touch /tmp/date_config;echo"lalala↗

path /tmp/netconfigpower↗

path /tmp/date_config↗

path /tmp/changepass↗

• → Monitor HTTP POST requests to /qcenter/hawkeye/v1/account?change_passwd, /qcenter/hawkeye/v1/network_config, and /qcenter/hawkeye/v1/date_config for base64-encoded payloads in the 'passwd' or 'new_password' fields containing shell metacharacters (e.g., semicolons, quotes) after decoding. ↗
• → Alert on GET requests to /qcenter/hawkeye/v1/account from non-admin roles (e.g., ROLE=1082130432 viewer, ROLE=1610612735 power user), which indicates exploitation of the privilege escalation to harvest the admin password. ↗
• → Detect creation of indicator files /tmp/netconfigpower, /tmp/changepass, or /tmp/date_config on the Q'center appliance filesystem, which are artifacts of PoC command injection payloads. ↗
• → The injection point for CVE-2018-0710 (SSH config update) follows the same pattern as CVE-2018-0708/0709: an unsanitized base64-encoded 'passwd' field passed to a sudo OS command. Monitor POST requests to the SSH settings API endpoint for the same base64-encoded shell injection patterns. ↗
• → The 'new_password' field in the JSON response from /qcenter/hawkeye/v1/account exposes the admin password in base64 (field name 'new_password'). Detect responses containing this field to identify successful credential harvesting. ↗

• · Exploitation of CVE-2018-0710 (SSH command injection) requires authentication. However, CVE-2018-0706 (information exposure) allows any authenticated user to retrieve the admin password in base64 from the account API, enabling privilege escalation as a prerequisite step. ↗
• · The command injection payloads are base64-encoded before submission to the API, meaning network-layer string-matching on raw shell metacharacters will not detect the attack without base64 decoding of the request body. ↗
• · Affected versions confirmed in testing are Q'center Virtual Appliance 1.6.1056 (20170825) and 1.6.1075 (20171123); NVD lists 1.7.1063 and earlier as vulnerable. Other versions may also be affected but were not tested. ↗

CVSS provenance

nvd v3.0 8.8 HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78