CVE-2024-50404: Qnap Qsync Central Path Traversal Vulnerability

CVE-2024-50404 Overview

CVE-2024-50404 is a link following vulnerability [CWE-59] affecting QNAP Qsync Central. The flaw allows remote authenticated attackers to traverse the file system to unintended locations by leveraging symbolic or hard links. Successful exploitation impacts file availability on affected NAS deployments running vulnerable Qsync Central builds.

QNAP addressed the issue in Qsync Central 4.4.0.16_20240819 and later, released on August 19, 2024. The vulnerability is documented in QNAP Security Advisory QSA-24-48.

Critical Impact
Authenticated remote attackers can abuse link following to reach files outside the intended Qsync Central directory scope, affecting integrity of file operations on QNAP NAS devices.

Affected Products

QNAP Qsync Central versions prior to 4.4.0.16_20240819
QNAP NAS devices running vulnerable Qsync Central builds
Multi-site deployments synchronizing data through Qsync Central

Discovery Timeline

2024-08-19 - QNAP releases Qsync Central 4.4.0.16_20240819 addressing the vulnerability
2024-12-06 - CVE-2024-50404 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-50404

Vulnerability Analysis

The vulnerability is a link following weakness [CWE-59] in Qsync Central, QNAP's centralized file synchronization service for NAS environments. When Qsync Central processes file paths during synchronization or user-initiated operations, it does not adequately validate whether path components resolve through symbolic links or hard links to locations outside the intended directory scope.

An attacker with valid user credentials can craft or place link objects that redirect file operations to attacker-chosen paths. The service then follows these links during normal processing, causing reads or writes to occur against unintended file system locations. The result is unauthorized file system traversal within the context of the Qsync Central service account.

Exploitation requires network access and low-privilege authentication. User interaction is a factor in the attack path, as reflected in the CVSS vector. The impact is limited to availability, with no direct confidentiality or integrity impact recorded in the vendor's scoring. EPSS data places exploitation probability at 1.394% (70.3 percentile).

Root Cause

Qsync Central does not sanitize or restrict file system links encountered while resolving user-controlled paths. Because link resolution occurs before access-control checks are re-evaluated against the resolved target, the service operates on paths outside the caller's intended sandbox. This is a canonical link following flaw pattern.

Attack Vector

The attacker authenticates to Qsync Central with any valid user account. They then introduce a symbolic or hard link within a directory they control, pointing at a target path elsewhere on the NAS file system. When Qsync Central performs a synchronization or file management operation that traverses the crafted link, the operation is applied against the linked target rather than the original path. No exploit code or public proof-of-concept has been published, and the flaw is not listed in the CISA KEV catalog.

Detection Methods for CVE-2024-50404

Indicators of Compromise

Unexpected symbolic links or hard links appearing within Qsync-managed directories on QNAP NAS devices.
File modifications or deletions on the NAS occurring outside the expected Qsync Central working directories.
Qsync Central service logs showing file operations resolving to paths outside standard user share boundaries.

Detection Strategies

Audit Qsync Central directory trees for symbolic links and hard links that point outside the owning user's share.
Monitor Qsync Central version reported by the QNAP App Center and flag any host running a version older than 4.4.0.16_20240819.
Correlate authenticated Qsync sessions with file system events that cross share boundaries or reach system directories.

Monitoring Recommendations

Enable QNAP system event logging and forward NAS logs to a central log platform for retention and search.
Alert on failed and successful login attempts to Qsync Central from unusual source addresses.
Track configuration and version drift across QNAP appliances to identify unpatched Qsync Central instances.

How to Mitigate CVE-2024-50404

Immediate Actions Required

Upgrade Qsync Central to version 4.4.0.16_20240819 or later through the QNAP App Center on each affected NAS.
Review Qsync Central user accounts and remove or disable accounts that are no longer required.
Inspect Qsync-managed directories for pre-existing symbolic or hard links that could be abused post-patch.

Patch Information

QNAP fixed CVE-2024-50404 in Qsync Central 4.4.0.16_20240819, released on August 19, 2024. Administrators should apply the update through the App Center on each QNAP NAS. Full remediation details are documented in QNAP Security Advisory QSA-24-48.

Workarounds

Restrict Qsync Central access to trusted networks using firewall rules or QNAP's built-in access control lists until patching is complete.
Enforce strong authentication and enable two-step verification for all Qsync Central user accounts.
Limit user permissions on Qsync-managed shares to the minimum required for synchronization tasks.

bash

# Verify installed Qsync Central version on a QNAP NAS via SSH
qpkg_cli --list | grep -i qsync

# Expected fixed version or later:
# Qsync Central 4.4.0.16_20240819