Pierluigi Paganini
March 29, 2023
Taiwanese vendor QNAP warns customers to update their network-attached storage (NAS) devices to address a high-severity Sudo privilege escalation vulnerability tracked as CVE-2023-22809.
The company states that the vulnerability affects QTS, QuTS hero, QuTScloud, and QVP (QVR Pro appliances) QNAP operating systems.
The vulnerability was discovered by security firm Synacktiv, it is a sudoers policy bypass in Sudo version 1.9.12p1 when using sudoedit. An attacker can trigger the vulnerability to achieve privilege escalation by editing unauthorized files after appending arbitrary entries to the list of files to process.
“Sudo uses user-provided environment variables to let its users select their editor of choice. The content of these variables extends the actual command passed to the sudo_edit() function. However, the latter relies on the presence of the — argument to determine the list of files to edit. The injection of an extra — argument in one of the authorized environment variables can alter this list and lead to privilege escalation by editing any other file with privileges of the RunAs user.” reads the advisory published by Synacktiv. “This issue occurs after the sudoers policy validation.”
The company already fixed the flaw in the following operating system versions:
“QNAP is urgently fixing the vulnerabilities in QuTScloud and QVP.” reads the advisory published by the vendor. “Please check this security advisory regularly for updates and promptly update your operating system to the latest recommended version as soon as it is available.”
The company recommends regularly updating NAS systems to the latest version.
Below are the instructions provided in the advisory to secure impacted devices:
Updating QTS, QuTS hero, or QuTScloud
Tip: You can also download the update from the QNAP website. Go to Support > Download Center and then perform a manual update for your specific device.
Updating QVP (QVR Pro Appliances)
Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections:
You can nominate yourself or your favourite blogger. We ask that you provide a brief paragraph of 250 words explaining why they should win.
Nominate here: https://docs.google.com/forms/d/e/1FAIpQLSfaFMkrMlrLhOBsRPKdv56Y4HgC88Bcji4V7OCxCm_OmyPoLw/viewform
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, QNAP)
