CVE-2024-50387
📋 TL;DR
A critical SQL injection vulnerability in QNAP SMB Service allows remote attackers to execute arbitrary SQL commands. This affects QNAP NAS devices running vulnerable SMB Service versions, potentially compromising data confidentiality, integrity, and availability.
💻 Affected Systems
- QNAP NAS devices
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise including data theft, ransomware deployment, lateral movement to other systems, and persistent backdoor installation
Likely Case
Data exfiltration, privilege escalation, and unauthorized access to sensitive files stored on the NAS
If Mitigated
Limited impact if network segmentation, strict access controls, and monitoring are implemented
🎯 Exploit Status
CVSS 9.8 indicates critical severity with network attack vector and no privileges required
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: SMB Service 4.15.002 or later, SMB Service h4.15.002 or later
Vendor Advisory: https://www.qnap.com/en/security-advisory/qsa-24-42
Restart Required: Yes
Instructions:
1. Log into QNAP web interface 2. Go to App Center 3. Check for updates 4. Update SMB Service to 4.15.002 or later 5. Reboot the NAS
🔧 Temporary Workarounds
Disable SMB Service
allTemporarily disable SMB file sharing to prevent exploitation
Go to Control Panel > Network & File Services > Win/Mac/NFS > Microsoft Networking > Disable SMB service
Network Segmentation
allRestrict SMB access to trusted networks only
Configure firewall rules to block SMB ports (445, 139) from untrusted networks
🧯 If You Can't Patch
- Implement strict network access controls to limit SMB exposure
- Enable comprehensive logging and monitoring for SMB service anomalies
🔍 How to Verify
Check if Vulnerable:
Check SMB Service version in App Center > Installed AppsCheck Version:
ssh admin@qnap-ip 'cat /etc/config/uLinux.conf | grep smb'Verify Fix Applied:
Verify SMB Service version is 4.15.002 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed authentication attempts followed by successful access
- Unexpected SMB protocol anomalies
Network Indicators:
- SQL injection patterns in SMB traffic
- Unusual outbound connections from NAS to external IPs
SIEM Query:
source="qnap-nas" AND (event="sql_error" OR protocol="smb" AND (pattern="' OR '1'='1" OR pattern="UNION SELECT"))