Pierluigi Paganini March 29, 2023

Taiwanese vendor QNAP warns customers to patch a high-severity Sudo privilege escalation bug affecting NAS devices.

Taiwanese vendor QNAP warns customers to update their network-attached storage (NAS) devices to address a high-severity Sudo privilege escalation vulnerability tracked as CVE-2023-22809.

The company states that the vulnerability affects QTS, QuTS hero, QuTScloud, and QVP (QVR Pro appliances) QNAP operating systems.

The vulnerability was discovered by security firm Synacktiv, it is a sudoers policy bypass in Sudo version 1.9.12p1 when using sudoedit. An attacker can trigger the vulnerability to achieve privilege escalation by editing unauthorized files after appending arbitrary entries to the list of files to process.

“Sudo uses user-provided environment variables to let its users select their editor of choice. The content of these variables extends the actual command passed to the sudo_edit() function. However, the latter relies on the presence of the — argument to determine the list of files to edit. The injection of an extra — argument in one of the authorized environment variables can alter this list and lead to privilege escalation by editing any other file with privileges of the RunAs user.” reads the advisory published by Synacktiv. “This issue occurs after the sudoers policy validation.”

The company already fixed the flaw in the following operating system versions:

• QTS 5.0.1.2346 build 20230322 and later
• QuTS hero h5.0.1.2348 build 20230324 and later

“QNAP is urgently fixing the vulnerabilities in QuTScloud and QVP.” reads the advisory published by the vendor. “Please check this security advisory regularly for updates and promptly update your operating system to the latest recommended version as soon as it is available.”

The company recommends regularly updating NAS systems to the latest version.

Below are the instructions provided in the advisory to secure impacted devices:

Updating QTS, QuTS hero, or QuTScloud

1. Log in to QTS, QuTS hero, or QuTScloud as an administrator.
2. Go to Control Panel > System > Firmware Update.
3. Under Live Update, click Check for Update.
   The system downloads and installs the latest available update.

Tip: You can also download the update from the QNAP website. Go to Support > Download Center and then perform a manual update for your specific device.

Updating QVP (QVR Pro Appliances)

1. Log in to QVP as an administrator.
2. Go to Control Panel > System Settings > Firmware Update.
3. Select the Firmware Update tab.
4. Click Browse… to upload the latest firmware file.
   Tip: Download the latest firmware file for your specific device from https://www.qnap.com/go/download.
5. Click Update System.
   The system installs the update.

Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections:

• The Teacher – Most Educational Blog
• The Entertainer – Most Entertaining Blog
• The Tech Whizz – Best Technical Blog
• Best Social Media Account to Follow (@securityaffairs)

You can nominate yourself or your favourite blogger. We ask that you provide a brief paragraph of 250 words explaining why they should win.

Nominate here: https://docs.google.com/forms/d/e/1FAIpQLSfaFMkrMlrLhOBsRPKdv56Y4HgC88Bcji4V7OCxCm_OmyPoLw/viewform

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, QNAP)