I have been talking a lot about various network storage devices and how you never ever want to expose them to the Internet. The brands that usually come up are Synology and QNAP, which have a significant market share. But they are not alone. Pretty much all these devices follow the same basic pattern: Build a reasonably powered server with a bunch of disks, and allow users to install various vulnerable web apps to manage these devices, or better: Install them by default and call them "Features."
Network vendor Zyxel is following the same pattern, and of course, we see scans targeting some of the vulnerabilities found in these devices. For example:
The URL is a bit "odd" because it includes a comma ahead of cgi-bin. But the exciting part follows the username "admin." Decoding it for readability:
wget.sh is the typical script downloading an ELF binary for various architectures:
The bot.x86_64 file downloaded is well recognized by Antivirus
The underlying vulnerability was disclosed about a year ago after the exploit had been seen for sale. It was in broader use at least around June last year.
As should be evident from the exploit above, the username is not escaped correctly/validated. A single quote is often associated with SQL injection, but various other injection vulnerabilities use similar patterns like the OS command injection in this case.
So double-check that your NAS, no matter the vendor, is up to date and NOT EXPOSED to the Internet.Application Security: Securing Web Apps, APIs, and Microservices - SANSFIRE 2022
Feb 10th 2022
|Thread locked Subscribe||
Feb 10th 2022
4 months ago