Concise and outcome-focused
Vulnerability details, root cause, impact, and remediation.
An unauthenticated X-Forwarded-For header reaches shell_exec() through a broken IP-validation helper that returns the raw input instead of its sanitized fallback. Yields code execution as www-data inside the Notes Station 3 container with no user interaction.
A www-data-writable crontab is installed by a root-owned monitor inside the container, and host home directories are bind-mounted writable with no user-namespace remapping. Chains from the pre-auth RCE to container root and then admin SSH on the NAS host.
An unauthenticated backup_restore handler concatenates _job_id into a SQL WHERE clause; db->escape() only handles single quotes and the value is interpolated unquoted, so the escape call is a no-op. Time-based blind extraction of contacts, IMAP and SMTP credentials, and live NAS_SID session rows.
Disclosure
We report vulnerabilities to affected vendors and generally work to a 90-day disclosure timeline, extending it when patch development reasonably requires more time.
For vendor coordination or bounty communication, email research@runiclabs.io.
