Description
An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHandler.cgi endpoint exposed through the web interface. The CGI script fails to properly sanitize user-supplied input in the timeZone parameter of a POST request, allowing remote attackers to inject arbitrary shell commands.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Raidsonic Technology GmbH IB-NAS5220
Default version status: unaffected
*affected
Raidsonic Technology GmbH IB-NAS4220
Default version status: unaffected
*affected
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/raidsonic_nas_ib5220_exec_noauth.rb ↗
- https://www.exploit-db.com/exploits/24499 ↗
- https://www.exploit-db.com/exploits/28508 ↗
- https://web.archive.org/web/20160616174425/http://www.s3cur1ty.de/m1adv2013-010 ↗
- https://www.vulncheck.com/advisories/raidsonic-nas-devices-unauth-rce ↗