CVE-2024-27130
HIGH EXPLOITEDQNAP QTS and QuTS hero - Remote Code Execution via Stack-based Buffer Overflow
Title source: llmExploitation Summary
CVE-2024-27130 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 3 public exploits from researchers including watchtowrlabs, d0rb, dkstar11q.
AI-analyzed exploit summary This PoC exploits a stack overflow vulnerability (CVE-2024-27130) in QNAP devices to achieve remote code execution (RCE) by creating a new user with sudo privileges and enabling SSH access. The exploit leverages a buffer overflow in the filemanager/share.cgi endpoint to execute arbitrary commands.
Description
A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute code via a network. We have already fixed the vulnerability in the following version: QTS 5.1.7.2770 build 20240520 and later QuTS hero h5.1.7.2770 build 20240520 and later
Exploits (3)
This PoC exploits a stack overflow vulnerability (CVE-2024-27130) in QNAP devices to achieve remote code execution (RCE) by creating a new user with sudo privileges and enabling SSH access. The exploit leverages a buffer overflow in the filemanager/share.cgi endpoint to execute arbitrary commands.
This repository contains a functional PoC for CVE-2024-27130, a buffer overflow vulnerability in QNAP QTS that allows remote command execution with root privileges. The exploit crafts a malicious payload to trigger a SIGSEGV and execute arbitrary commands, including creating a new user with sudo privileges.
This PoC exploits a stack-based buffer overflow in QNAP NAS devices via the `share.cgi` script's `No_Support_ACL` function, allowing unauthenticated remote code execution. It creates a backdoor user with sudo privileges and initiates an SSH session.
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L