Critical PHP Flaw Exposes QNAP NAS Devices to RCE Attacks - Binary Defense

Threat Watch

Threat Watch Critical PHP Flaw Exposes QNAP NAS Devices to RCE Attacks

Critical PHP Flaw Exposes QNAP NAS Devices to RCE Attacks

QNAP warned customers today that most of its Network Attached Storage (NAS) devices are vulnerable to attacks that would exploit a three-year-old critical PHP vulnerability that allowsremote code execution. “A vulnerability has been reported to affect PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24, and 7.3.x below 7.3.11. If exploited, the vulnerability allows attackers to gain remote code execution,” QNAP explained in a security advisory released today. The Taiwanese hardware vendor has already patched the security flaw (CVE-2019-11043) for some operating system versions exposed to attacks (QTS 5.0.1.2034 build 20220515 or later and QuTShero h5.0.0.2069 build 20220614 or later). Today’s warning comes after the NAS maker warned its customers on Thursday to secure their devices against active attacks deploying DeadBolt ransomware payloads. Reporters also reported over the weekend that ech0raix ransomware has started targeting vulnerable QNAP NAS devices again, according to sample submissions on the ID Ransomware platform and reports from multiple users who had their systems encrypted.Until QNAP issues more details on ongoing attacks, the infection vector used in these new DeadBolt and ech0raix campaigns remains unknown.

ANALYST NOTES

QNAP customers who want to update their NAS devices to the latest firmware automatically need to log on to QTS, QuTS hero, or QuTScloud as administrator and click the “Check for Update” button under Control Panel > System > Firmware Update. Administrators can also manually upgrade devices after downloading the update on the QNAP website from Support > Download Center.

While QNAP is working on patching the CVE-2019-11043 PHP vulnerability in all vulnerable firmware versions, administrators should ensure that devices are not exposed to the Internet as an easy way to block incoming attacks. As QNAP has advised in the past, users with Internet-exposed NAS devices should take the following measures to prevent remote access:
• Disable the Port Forwarding function of the router: Go to the management interface of your router, check the Virtual Server, NAT, or Port Forwarding settings, and disable the port forwarding setting of the NAS management service port (port 8080 and 433 by default).
• Disable the UPnP function of the QNAP NAS: Go to myQNAPcloud on the QTS menu, click the “Auto Router Configuration,” and unselect “Enable UPnP Port forwarding.”

https://www.bleepingcomputer.com/news/security/critical-php-flaw-exposes-qnap-nas-devices-to-rce-attacks/