CVE-2023-4475
📋 TL;DR
An arbitrary file movement vulnerability in ASUSTOR Data Master (ADM) allows attackers to exploit the file renaming feature to move files to unintended directories. This affects ADM versions 4.0.6.RIS1, 4.1.0 and below, as well as ADM 4.2.2.RI61 and below. Attackers could potentially move sensitive files to accessible locations.
💻 Affected Systems
- ASUSTOR Data Master (ADM)
📦 What is this software?
Data Master by Asustor
⚠️ Risk & Real-World Impact
Worst Case
Attackers could move sensitive system files to web-accessible directories, potentially exposing credentials, configuration files, or enabling further system compromise.
Likely Case
Unauthorized movement of user data files, potentially exposing sensitive documents or enabling data theft.
If Mitigated
Limited impact if proper access controls and network segmentation are in place, restricting attacker access to critical directories.
🎯 Exploit Status
Requires authenticated access to the ADM interface. The vulnerability is in the file renaming functionality.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ADM 4.0.6.RIS2, 4.1.1, 4.2.2.RI62 or later
Vendor Advisory: https://www.asustor.com/security/security_advisory_detail?id=30
Restart Required: Yes
Instructions:
1. Log into ADM web interface. 2. Go to Settings > ADM Update. 3. Check for updates and install the latest version. 4. Restart the NAS when prompted.
🔧 Temporary Workarounds
Restrict ADM Web Interface Access
allLimit access to the ADM web interface to trusted IP addresses only.
Disable Unnecessary Services
allDisable any unnecessary file sharing or management services that provide access to the vulnerable functionality.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate ASUSTOR devices from untrusted networks
- Enable detailed logging and monitoring for file movement operations in ADM
🔍 How to Verify
Check if Vulnerable:
Check ADM version in Settings > ADM Update. If version is 4.0.6.RIS1 or below, or 4.1.0 or below, or 4.2.2.RI61 or below, the system is vulnerable.Check Version:
Check via ADM web interface: Settings > ADM UpdateVerify Fix Applied:
Verify ADM version is 4.0.6.RIS2, 4.1.1, 4.2.2.RI62 or later after update.📡 Detection & Monitoring
Log Indicators:
- Unusual file rename operations moving files between directories
- Multiple failed rename attempts followed by successful moves
Network Indicators:
- Unusual HTTP POST requests to file management endpoints from unexpected sources
SIEM Query:
source="asustor_adm" AND (event_type="file_rename" OR event_type="file_move") AND src_path!="*" AND dest_path CONTAINS "/web/" OR dest_path CONTAINS "/public/"