The latest firmware version for Seagate 's professional NAS storage devices has found vulnerable versions of PHP and CodeIgniter in the web-based management menu, which could allow a remote attacker to execute arbitrary code.
The attack script does not need to receive any kind of validation to exploit the issues and is able to execute code in the user's root environment, which allows full control of the device and potentially access to other devices on the same network.
Security consulting firm Beyond Binary discovered that the management application included in firmware 2014.00319 is based on PHP 5.2.13 (Build 5.6.6, 5.5.22, and 5.4.38) and CodeIgniter 2.1.0 (Build 2.2.1), which have known security vulnerabilities.
In the case of PHP, an old security flaw, CVE-2006-7243, allows a null byte input (“\0”), which blocks everything after it. This could allow an attacker to bypass access restrictions by placing a safe file after the null byte and upload malicious code via the require() and include() functions.
In the case of the problematic version of CodeIgniter, an open source is included with Seagate NAS devices, so that the encryption file can be extracted and used to decrypt the cookie of the operation performed. By changing the content of the cookie, the attacker could carry out additional attacks, as well as inject a PHP object of their own, according to the researchers.
But the problem goes deeper, since, as the relevant report by Beyond Binary states, Seagate uses the same encryption key for its entire line of problematic NAS devices.
For its part, Seagate, although it has been informed of the issue, has not taken any action to fix the problem in the NAS devices. For this reason, Beyond Binary proceeded to make the issue public, after the period it had given the NAS manufacturer to correct the vulnerabilities had expired.
