EasyNAS OS command injection

Technical summary

EasyNAS is a web-managed storage appliance. Its /backup.pl CGI script passes attacker-influenced data into Perl’s system function, so that data is interpreted by the shell rather than treated as an operand.

The published vectors put the attack vector at network and privileges required at low; VulDB’s own submission titles the issue “Authenticated OS Command Injection”, so an account on the appliance is needed. Four published scores exist and they disagree sharply on impact — NVD rates it 8.8 High, VulDB 6.3 Medium under CVSS 3.1 and 5.3 Medium under CVSS 4.0. All are shown above as published.

Impact

Command execution on the appliance in the context of the web application, which on a storage appliance means access to the data it serves.

A vulnerability classified as critical has been found in EasyNAS 1.1.0. Affected is the function system of the file /backup.pl. The manipulation leads to os command injection.

Remediation

The published record names no fixed version and no vendor advisory, so neither is stated here.

Disclosure timeline

1. 2023-02-14Advisory disclosed
2. 2023-02-14CVE record published

Dates as recorded in the CVE record’s own timeline field. See the record.

References

• NVD entry
• CVE record (MITRE)
• VulDB entry VDB-220950
• Exploit-DB 51266

We publish advisories, not exploits. Each entry describes the vulnerability class and impact at the level the vendor advisory does, and links to the authoritative records. Where public proof-of-concept code exists we link to it rather than reproduce it.