CVE-2018-19943
QNAP NAS File Station Cross-Site Scripting Vulnerability
Description
CVE-2018-19943 is a cross-site scripting (XSS) vulnerability in QNAP NAS File Station that allows remote attackers to inject malicious code into the web management interface. By exploiting this flaw, an attacker can execute arbitrary JavaScript in the browser of an authenticated user, enabling session hijacking, credential theft, and unauthorized actions on the NAS device. CISA has confirmed active exploitation and flagged CVE-2018-19943 as associated with ransomware campaigns targeting network-attached storage devices. With an EPSS percentile of 90.1%, this vulnerability represents a significant exploitation risk.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| qnap | qts | < 4.2.6; >= 4.3.1.0013, < 4.3.3.1252; >= 4.3.4, < 4.3.4.1282; >= 4.3.6, < 4.3.6.1263; >= 4.4.0, < 4.4.1.1261; >= 4.4.2, < 4.4.2.1270; 4.2.6 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- https://www.qnap.com/zh-tw/security-advisory/qsa-20-01(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19943(US Government Resource)
Weakness Type
Since no specific CWE has been assigned to CVE-2018-19943, the underlying weakness type remains formally unspecified. However, the vulnerability is a cross-site scripting (XSS) flaw in the QNAP NAS File Station web interface, where user-supplied input is included in dynamically generated web pages without adequate sanitization or output encoding. This allows attackers to inject JavaScript code that executes in the context of other users' browser sessions.
Impact Analysis
CVE-2018-19943 enables cross-site scripting attacks against QNAP NAS users through the File Station web interface. An attacker who successfully exploits this vulnerability can steal authentication tokens and session cookies from NAS administrators, perform unauthorized file operations (upload, download, delete, or modify files) through the hijacked session, redirect users to phishing pages designed to capture NAS or network credentials, and install persistent XSS payloads that affect all users accessing the compromised interface. QNAP NAS devices are widely deployed as centralized storage in homes, small businesses, and enterprise environments, often containing critical backups, confidential documents, and sensitive media. CISA's ransomware association indicates that this XSS vulnerability has been exploited as part of multi-stage ransomware attacks against NAS devices. The EPSS percentile of 90.1% confirms significant real-world exploitation activity.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2018-19943 by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 14, 2022. CISA has flagged this vulnerability as associated with ransomware campaigns, confirming it has been used in ransomware attacks targeting QNAP NAS devices. The EPSS percentile of 90.1% indicates high exploitation probability. This vulnerability is closely related to CVE-2018-19953, another XSS flaw in QNAP File Station, and both have been targeted in the same ransomware campaigns. NAS-focused ransomware families have systematically exploited multiple QNAP vulnerabilities to maximize the reach of their campaigns.
Remediation
- Apply firmware updates from QNAP that address CVE-2018-19943 immediately. CISA's required action is to apply updates per vendor instructions.
- Remove the NAS device from direct internet exposure by disabling UPnP port forwarding and removing any manual port forwarding rules for the web management interface.
- Enable HTTPS for the QNAP web interface to protect against man-in-the-middle attacks that could deliver XSS payloads, and configure Content Security Policy (CSP) headers if supported.
- Audit NAS user accounts and access logs for any unauthorized activity, suspicious sessions, or unexpected administrative changes that may indicate prior exploitation.
- Implement network segmentation to isolate the NAS device, and configure access controls to limit web interface access to authorized administrator systems only.
Technical Details
CVE-2018-19943 is a cross-site scripting vulnerability in the File Station component of QNAP NAS devices. The vulnerability exists because the File Station web application does not properly sanitize or encode user-controlled input before rendering it in HTML pages served to users' browsers. An attacker can inject malicious JavaScript code through crafted requests to the File Station interface. When another user (typically an administrator) accesses the affected page, the injected JavaScript executes in their browser with the full permissions of their authenticated session. The script can access the DOM of the File Station application, including authentication cookies, CSRF tokens, and all file management functionality. This is particularly dangerous on NAS devices where the web interface provides access to all stored files and system configuration, meaning a successful XSS attack can be leveraged for complete data access and device control.
Frequently Asked Questions
Is CVE-2018-19943 being actively exploited?
Yes, CISA has confirmed active exploitation of CVE-2018-19943 and has flagged it as associated with ransomware campaigns. The EPSS percentile of 90.1% confirms significant exploitation probability. It has been targeted alongside related QNAP vulnerabilities such as CVE-2018-19953 in ransomware campaigns against NAS devices.
What products are affected by CVE-2018-19943?
CVE-2018-19943 affects QNAP Network Attached Storage (NAS) devices, specifically the File Station web interface component. All QNAP NAS models running firmware versions containing this XSS vulnerability are affected until firmware is updated.
How do I fix CVE-2018-19943?
Apply the latest firmware updates from QNAP that address CVE-2018-19943. Remove the NAS from direct internet exposure and ensure the web interface is only accessible from trusted internal networks or through a VPN.
How severe is CVE-2018-19943?
CVE-2018-19943 is a cross-site scripting vulnerability with an EPSS percentile of 90.1% and a confirmed ransomware association. While XSS is often considered a lower-severity vulnerability class, its use in ransomware attack chains against NAS devices — which store critical data — elevates its practical severity significantly.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.