Qnap Security Advisories: QSA-21-41, QSA-21-42 and QSA-21-43

Qnap Systems, Inc. has published 3 security advisories.

Stored XSS Vulnerabilities in Photo Station

Release date: October 1, 2021
Security ID: QSA-21-41
Severity: High
CVE identifier: CVE-2021-34354 | CVE-2021-34356
Affected products: Certain Qnap NAS running Photo Station
Status: Resolved

Summary
Two stored cross-site scripting (XSS) vulnerabilities have been reported to affect QNAP NAS running Photo Station. If exploited, these vulnerabilities allow remote attackers to inject malicious code.

The company have already fixed these vulnerabilities in following versions of Photo Station: 

• Photo Station 6.0.18 (2021/09/01) and later

Recommendation
To fix the vulnerabilities, we recommend updating Photo Station to the latest version.

Updating Photo Station

1. Log on to QTS as administrator.

2. Open the App Center and then click .
   A search box appears.

3. Type ‘Photo Station’ and then press ENTER.
   Photo Station appears in the search results.

4. Click Update.
   A confirmation message appears.
   Note: The Update button is not available if your version is already up to date.

5. Click OK.
   The application is updated.

Acknowledgements: Tony Martin, a security researcher

Revision History: V1.0 (October 1, 2021) – Published

Stored XSS Vulnerability in Photo Station

Release date: October 1, 2021
Security ID: QSA-21-42
Severity: High
CVE identifier: CVE-2021-34355
Affected products: Certain Qnap NAS running Photo Station
Status: Resolved

Summary
A stored cross-site scripting (XSS) vulnerability has been reported to affect Qnap NAS running Photo Station. If exploited, this vulnerability allows remote attackers to inject malicious code.

The company have already fixed this vulnerability in following versions of Photo Station: 

• Photo Station 6.0.18 (2021/09/01) and later

• Photo Station 5.7.13 (2021/08/19) and later

• Photo Station 5.4.10 (2021/08/19) and later

Recommendation
To fix the vulnerability, we recommend updating Photo Station to the latest version.

Updating Photo Station

1. Log on to QTS as administrator.

2. Open the App Center and then click .
   A search box appears.

3. Type ‘Photo Station’ and then press ENTER.
   Photo Station appears in the search results.

4. Click Update.
   A confirmation message appears.
   Note: The Update button is not available if your version is already up to date.

5. Click OK.
   The application is updated.

Acknowledgements: Tony Martin, a security researcher

Revision History: V1.0 (October 1, 2021) – Published

Stored XSS Vulnerability in Image2PDF

Release date: October 1, 2021
Security ID: QSA-21-43
Severity: Medium
CVE identifier: CVE-2021-38675
Affected products: Certain Qnap NAS running Image2PDF
Status: Resolved

Summary
A stored cross-site scripting (XSS) vulnerability has been reported to affect Qnap NAS running Image2PDF. If exploited, this vulnerability allows remote attackers to inject malicious code.

The company have already fixed this vulnerability in  following versions of Image2PDF: 

• Image2PDF 2.1.5 (2021/08/17) and later

Recommendation
To fix the vulnerability, we recommend updating Image2PDF to the latest version.

Updating Image2PDF

1. Log on to QTS or QuTS hero as administrator.

2. Open the App Center and then click.
   A search box appears.

3. Type ‘Image2PDF’ and then press ENTER.
   Image2PDF appears in the search results.

4. Click Update.
   A confirmation message appears.
   Note: The Update button is not available if your version is already up to date.

5. Click OK.
   The application is updated.

Acknowledgements: Tony Martin, a security researcher

Revision History: V1.0 (October 1, 2021) – Published