=====================================================================

                                 CERT-Renater

                       Note d'Information No. 2023/VULN455

_____________________________________________________________________

DATE                : 06/11/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running QTS versions 5.1.x, 5.0.x, 4.5.x;
                       QuTS hero versions h5.1.x, h5.0.x, h4.5.x;
                       QuTScloud versions c5.0.1, c5.x.

=====================================================================
https://www.qnap.com/en/security-advisory/qsa-23-31
https://www.qnap.com/en/security-advisory/qsa-23-51
_____________________________________________________________________

QSA-23-31
Vulnerability in QTS, QuTS hero, and QuTScloud

     Release date : November 4, 2023

     CVE identifier : CVE-2023-23368

     Affected products: QTS 5.0.x, 4.5.x; QuTS hero h5.0.x, h4.5.x;
QuTScloud c5.0.1


Severity
Critical

Status
Resolved


Summary

An OS command injection vulnerability has been reported to affect
several QNAP operating system versions. If exploited, the vulnerability
could allow remote attackers to execute commands via a network.

We have already fixed the vulnerability in the following versions:

Affected Product                 Fixed Version
QTS 5.0.x             QTS 5.0.1.2376 build 20230421 and later
QTS 4.5.x             QTS 4.5.4.2374 build 20230416 and later
QuTS hero h5.0.x      QuTS hero h5.0.1.2376 build 20230421 and later
QuTS hero h4.5.x      QuTS hero h4.5.4.2374 build 20230417 and later
QuTScloud c5.0.x      QuTScloud c5.0.1.2374 and later
Recommendation

To secure your device, we recommend regularly updating your system
to the latest version to benefit from vulnerability fixes. You can
check the product support status to see the latest updates available
to your NAS model.


Updating QTS, QuTS hero, or QuTScloud

     Log in to QTS, QuTS hero, or QuTScloud as an administrator.
     Go to Control Panel > System > Firmware Update.
     Under Live Update, click Check for Update.
     The system downloads and installs the latest available update.

Tip: You can also download the update from the QNAP website. Go to
Support > Download Center and then perform a manual update for your
specific device.


Attachment

     CVE-2023-23368.json

Acknowledgements: CataLpa of Hatlab, Dbappsecurity Co. Ltd.


Revision History:
V1.0 (November 4, 2023) - Published

_____________________________________________________________________

Security ID : QSA-23-51
Vulnerability in QTS, QuTS hero, and QuTScloud

     Release date : November 4, 2023

     CVE identifier : CVE-2023-39301

     Affected products: QTS 5.1.x, 5.0.x; QuTS hero h5.1.x, h5.0.x;
QuTScloud c5.x


Severity
Medium

Status
Resolved


Summary

A server-side request forgery (SSRF) vulnerability has been reported
to affect several QNAP operating system versions. If exploited, the
vulnerability could allow authenticated users to read application
data via a network.

We have already fixed the vulnerability in the following affected
versions:

    Affected Product               Fixed Version
QTS 5.1.x           QTS 5.1.1.2491 build 20230815 and later
QTS 5.0.x           QTS 5.0.1.2514 build 20230906 and later
QuTS hero h5.1.x    QuTS hero h5.1.1.2488 build 20230812 and later
QuTS hero h5.0.x    QuTS hero h5.0.1.2515 build 20230907 and later
QuTScloud c5.x      QuTScloud c5.1.0.2498 and later


Recommendation

To secure your device, we recommend regularly updating your system to
the latest version to benefit from vulnerability fixes. You can check
the product support status to see the latest updates available to your
NAS model.

Updating QTS, QuTS hero, or QuTScloud

     Log in to QTS, QuTS hero, or QuTScloud as an administrator.
     Go to Control Panel > System > Firmware Update.
     Under Live Update, click Check for Update.
     The system downloads and installs the latest available update.

Tip: You can also download the update from the QNAP website. Go to
Support > Download Center and then perform a manual update for your
specific device.


Attachment

     CVE-2023-39301.json

Acknowledgements: Aymen BORGI and Ibrahim AYADHI from RandoriSec

Revision History:
V1.0 (November 4, 2023) - Published


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================