Authentification manquante pour une fonction critique dans le serveur RTRR dans HBS3

The improper access control vulnerability in QNAP HBS 3 allows an attacker to bypass security mechanisms and gain unauthorized access to system resources. This could involve reading sensitive data, modifying system configurations, installing malware, or even taking complete control of the affected device. The potential blast radius is significant, as a compromised HBS 3 instance could serve as a pivot point for further attacks within the network. Given HBS 3's role in backup and data management, attackers could potentially exfiltrate sensitive data or disrupt critical business operations. While no direct precedent for exploitation of this specific vulnerability has been publicly reported, similar access control bypasses in other network-attached storage (NAS) devices have historically led to widespread data breaches and ransomware attacks.

Organizations utilizing legacy QNAP HBS 3 installations, particularly those with shared hosting environments or those running older QTS versions, are at heightened risk. Environments where HBS 3 is exposed directly to the internet or lacks proper network segmentation are also particularly vulnerable.

• linux / server:

journalctl -u hbs3 | grep -i "error" -i "exception"

• generic web:

curl -I http://<HBS3_IP>/  # Check for unexpected response codes or exposed directories

• windows / supply-chain: (If HBS 3 is accessed via Windows)

Get-Process -Name hbs3  # Check if the process is running unexpectedly

1. 2021-07-08Disclosure

   disclosure

2. 2021-07-08Patch

   patch

1. Réservé2021-03-18
2. Publiée2021-07-08
3. Modifiée2024-09-17
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2021-28809 is to upgrade QNAP HBS 3 to version v3.0.210507 or later, depending on the QTS version in use (4.3.6, 4.3.4, or 4.3.3). If immediate upgrading is not possible, implement stricter access controls within HBS 3, limiting user privileges and restricting access to sensitive data. Network segmentation can also help isolate HBS 3 instances from other critical systems, reducing the potential impact of a successful attack. Consider implementing a Web Application Firewall (WAF) to filter malicious traffic targeting HBS 3. After upgrading, verify the fix by attempting to access restricted resources with a non-privileged user account; access should be denied.