CVE-2024-50395: QNAP Media Streaming Auth Bypass Flaw

CVE-2024-50395 Overview

CVE-2024-50395 is an authorization bypass vulnerability in the QNAP Media Streaming add-on. The flaw is classified as authorization bypass through user-controlled key [CWE-639]. Local network attackers can exploit the issue to gain elevated privileges on affected NAS devices. QNAP addressed the vulnerability in Media Streaming add-on version 500.1.1.6 released on 2024/08/02.

Critical Impact
Successful exploitation allows attackers on the local network to bypass authorization checks and gain privileges on QNAP devices running vulnerable Media Streaming add-on versions.

Affected Products

QNAP Media Streaming add-on versions prior to 500.1.1.6
QNAP NAS devices with the Media Streaming add-on installed
QTS and QuTS hero deployments using the affected add-on

Discovery Timeline

2024-11-22 - CVE-2024-50395 published to NVD
2025-12-08 - Last updated in NVD database

Technical Details for CVE-2024-50395

Vulnerability Analysis

The vulnerability stems from improper authorization handling in the Media Streaming add-on. The application accepts a user-controlled key to identify or reference resources without verifying that the requesting user is permitted to access them. An attacker on the local network can manipulate the key parameter to access functions or data belonging to another user or to a higher privilege context. The flaw maps to [CWE-639] Authorization Bypass Through User-Controlled Key, a class of insecure direct object reference (IDOR) defect. The Exploit Prediction Scoring System places this CVE at the 92.5th percentile, indicating relatively elevated likelihood of exploitation activity compared to the broader CVE population.

Root Cause

The Media Streaming add-on trusts a client-supplied identifier when authorizing access to resources or actions. The server fails to validate the identifier against the authenticated session's privilege scope. As a result, a modified request referencing a privileged resource is processed without rejection.

Attack Vector

Exploitation requires network reachability to the QNAP device and some user interaction according to the CVSS 4.0 vector. An attacker crafts requests to the Media Streaming add-on endpoints and substitutes the key value with one referencing privileged resources. No authentication is required to attempt the request. Successful exploitation yields a high impact on confidentiality of the targeted vulnerable system.

No public proof-of-concept code has been published for this CVE. Refer to the QNAP Security Advisory QSA-24-47 for vendor technical details.

Detection Methods for CVE-2024-50395

Indicators of Compromise

Unexpected HTTP requests to Media Streaming add-on endpoints originating from local network hosts that should not interact with the service.
Authorization-related log entries showing access to resources outside the requesting account's normal scope.
Installations of Media Streaming add-on with versions earlier than 500.1.1.6 detected during inventory scans.

Detection Strategies

Inventory all QNAP NAS devices and identify those running Media Streaming add-on versions below 500.1.1.6.
Inspect web server and add-on logs for requests that iterate or manipulate identifier parameters in URLs or POST bodies.
Correlate Media Streaming add-on access logs with user session data to surface mismatches between the authenticated user and the resource accessed.

Monitoring Recommendations

Forward QNAP system and application logs to a centralized log platform for retention and analysis.
Alert on repeated 4xx and 2xx responses from Media Streaming endpoints that suggest enumeration of resource identifiers.
Monitor administrative actions on NAS devices for changes that follow anomalous Media Streaming requests.

How to Mitigate CVE-2024-50395

Immediate Actions Required

Update the Media Streaming add-on to version 500.1.1.6 (released 2024/08/02) or later via the QNAP App Center.
Restrict access to the Media Streaming service to trusted network segments using firewall rules.
Disable or uninstall the Media Streaming add-on on devices where the functionality is not required.

Patch Information

QNAP released the fix in Media Streaming add-on 500.1.1.6 on 2024/08/02. Administrators should apply the update through App Center on each affected NAS device. Full advisory details are available in the QNAP Security Advisory QSA-24-47.

Workarounds

Block external and untrusted internal access to Media Streaming add-on ports at the network perimeter and on internal segmentation devices.
Disable the Media Streaming add-on through QNAP App Center until the patch can be applied.
Limit NAS user accounts to least-privilege roles to reduce the blast radius of privilege gain through this flaw.

bash

# Verify Media Streaming add-on version on a QNAP device
# Run via SSH against the appliance
qpkg_cli --version MediaStreamingAddOn