HTTP: QNAP Multiple Products HLS_tmp Directory Traversal

This signature detects attempts to exploit a known vulnerability against QNAP. A successful attack can lead to directory traversal and arbitrary code execution.

Extended Description

A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.4.2596 build 20231128 and later QTS 4.5.4.2627 build 20231225 and later QuTS hero h5.1.3.2578 build 20231110 and later QuTS hero h4.5.4.2626 build 20231225 and later QuTScloud c5.1.5.2651 and later

References

CVE: CVE-2023-51365

URL: https://www.qnap.com/en/security-advisory/qsa-24-14 http://www.zerodayinitiative.com/advisories/ZDI-24-476/

Short Name

HTTP:DIR:QNAP-MULTI-PD-TRAVSAL

Severity

Major

Recommended

False

Recommended Action

Drop

HTTP: QNAP Multiple Products HLS_tmp Directory Traversal

Extended Description

References

Found a potential security threat?