QNAS QTS update for Apache HTTP Server



Published: 2022-08-16
Risk Medium
Patch available YES
Number of vulnerabilities 8
CVE-ID CVE-2022-26377
CVE-2022-28330
CVE-2022-28614
CVE-2022-28615
CVE-2022-29404
CVE-2022-30522
CVE-2022-30556
CVE-2022-31813
CWE-ID CWE-444
CWE-125
CWE-20
CWE-400
CWE-287
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
QNAP QTS
Server applications / File servers (FTP/HTTP)

Vendor QNAP Systems, Inc.

Security Bulletin

This security bulletin contains information about 8 vulnerabilities.

1) Inconsistent interpretation of HTTP requests

EUVDB-ID: #VU64078

Risk: Medium

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26377

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to improper validation of HTTP requests in mod_proxy_ajp. A remote attacker can send a specially crafted HTTP request to the server and smuggle requests to the AJP server it forwards requests to.

Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

QNAP QTS: 4.3.2 - 5.4.1

External links

http://www.qnap.com/en/security-advisory/qsa-22-23


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds read

EUVDB-ID: #VU64080

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-28330

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition with the mod_isapi module. A remote attacker can send a specially crafted HTTP request to the server, trigger an out-of-bounds read error and read contents of memory on the system or perform a denial of service (DoS) attack.

Note, only Windows installations are affected by this vulnerability.

Mitigation

Install update from vendor's website.

Vulnerable software versions

QNAP QTS: 4.3.2 - 5.4.1

External links

http://www.qnap.com/en/security-advisory/qsa-22-23


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Out-of-bounds read

EUVDB-ID: #VU64081

Risk: Low

CVSSv3.1: 3.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-28614

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the ap_rwrite() function. A remote attacker can with the ability to force the server to reflect a very large input using ap_rwrite() or ap_rputs() (such as with mod_luas r:puts() function) can trigger an out-of-bounds read error and read read unintended memory on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

QNAP QTS: 4.3.2 - 5.4.1

External links

http://www.qnap.com/en/security-advisory/qsa-22-23


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Out-of-bounds read

EUVDB-ID: #VU64083

Risk: Low

CVSSv3.1: 3.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-28615

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition within the ap_strcmp_match() function when processing an extremely large input buffer. A remote attacker can send a specially crafted HTTP request to the web server, trigger an out-of-bounds read error and read contents of memory on the system.

Note, the code distributed with the Apache HTTP Server cannot be coerced into such a call. The vulnerability can affect third-party modules or lua scripts that use ap_strcmp_match().

Mitigation

Install update from vendor's website.

Vulnerable software versions

QNAP QTS: 4.3.2 - 5.4.1

External links

http://www.qnap.com/en/security-advisory/qsa-22-23


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Input validation error

EUVDB-ID: #VU64085

Risk: Medium

CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-29404

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when processing HTTP requests to a lua script that calls r:parsebody(0). A remote attacker can send a very large HTTP request to the affected web server and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

QNAP QTS: 4.3.2 - 5.4.1

External links

http://www.qnap.com/en/security-advisory/qsa-22-23


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource exhaustion

EUVDB-ID: #VU64086

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30522

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to mod_sed does not properly control consumption of internal resources, if the web server is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

QNAP QTS: 4.3.2 - 5.4.1

External links

http://www.qnap.com/en/security-advisory/qsa-22-23


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Out-of-bounds read

EUVDB-ID: #VU64088

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30556

CWE-ID: CWE-125 - Out-of-bounds read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a boundary condition when processing HTTP requests in mod_lua with websockets. A remote attacker can force the module to return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer and gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

QNAP QTS: 4.3.2 - 5.4.1

External links

http://www.qnap.com/en/security-advisory/qsa-22-23


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improper Authentication

EUVDB-ID: #VU64089

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-31813

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in mod_proxy implementation, where the web server may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. A remote attacker can bypass IP based authentication on the origin server/application and gain access to otherwise restricted functionality.

Mitigation

Install update from vendor's website.

Vulnerable software versions

QNAP QTS: 4.3.2 - 5.4.1

External links

http://www.qnap.com/en/security-advisory/qsa-22-23


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###