CVE-2021-28799 : Exploit Details and Defense Strategies

An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync.) If exploited, the vulnerability allows remote attackers to log into a device. This issue impacts QNAP Systems Inc. HBS 3 versions prior to v16.0.0415 on QTS 4.5.2, versions before v3.0.210412 on QTS 4.3.6, versions before v3.0.210411 on QTS 4.3.4 and 4.3.3, versions before v16.0.0419 on QuTS hero h4.5.1, and versions before v16.0.0419 on QuTScloud c4.5.1~c4.5.4. However, it does not affect QNAP Systems Inc. HBS 2 or HBS 1.3.

Understanding CVE-2021-28799

This vulnerability is due to an improper authorization issue that could be exploited by remote attackers to gain unauthorized access to vulnerable NAS devices.

What is CVE-2021-28799?

CVE-2021-28799 is an improper authorization vulnerability affecting QNAP NAS devices running HBS 3. It allows remote attackers to log into vulnerable devices.

The Impact of CVE-2021-28799

The impact of this vulnerability is rated as CRITICAL with a CVSS base score of 10. It has a HIGH impact on confidentiality, integrity, and availability with LOW attack complexity and requires no privileges for exploitation.

Technical Details of CVE-2021-28799

This section covers the technical details and specifics of the CVE.

Vulnerability Description

The vulnerability arises from improper authorization within HBS 3, potentially enabling unauthorized access to the system.

Affected Systems and Versions

QTS 4.5.2: HBS 3 versions prior to v16.0.0415
QTS 4.3.6: HBS 3 versions prior to v3.0.210412
QTS 4.3.4 / 4.3.3: HBS 3 versions prior to v3.0.210411
QuTS hero h4.5.1: HBS 3 versions prior to v16.0.0419
QuTScloud c4.5.1~c4.5.4: HBS 3 versions prior to v16.0.0419

Exploitation Mechanism

The vulnerability can be exploited by remote attackers over a network without the need for any user interaction, leading to unauthorized access to the device.

Mitigation and Prevention

To address CVE-2021-28799 and enhance system security, follow these mitigation strategies:

Immediate Steps to Take

Update HBS 3 to fixed versions: v16.0.0415 and later for QTS 4.5.2, v3.0.210412 and later for QTS 4.3.6, v3.0.210411 and later for QTS 4.3.3/4, v16.0.0419 and later for QuTS hero h4.5.1, and v16.0.0419 and later for QuTScloud c4.5.1~c4.5.4.

Long-Term Security Practices

Regularly update software and firmware to apply security patches.
Implement network security measures to restrict unauthorized access.
Monitor system logs and network traffic for any suspicious activities.

Patching and Updates

Install the latest security updates and patches provided by QNAP to ensure the resolution of the improper authorization vulnerability.