Full Report
QNAP warned customers to patch a critical ASP.NET Core vulnerability that also impacts the company's NetBak PC Agent, a Windows utility for backing& up data to a QNAP network-attached storage (NAS) device. [...]
Analysis Summary
# Vulnerability: Critical ASP.NET Core HTTP Request Smuggling in QNAP NetBak PC Agent
## CVE Details
- CVE ID: CVE-2025-55315
- CVSS Score: Not explicitly provided in text, but referred to by Microsoft as having the **"highest ever" severity rating** for an ASP.NET Core flaw. (Implies a very high CVSS score, likely 9.0+)
- CWE: HTTP Request Smuggling (Related to CWE-444, Inappropriate Data Handling for Resource)
## Affected Systems
- Products: QNAP NetBak PC Agent (Windows utility)
- Versions: Any version of NetBak PC Agent that relies on an unpatched version of the underlying Microsoft ASP.NET Core components.
- Configurations: Any system running NetBak PC Agent where the dependent ASP.NET Core runtime has not been manually updated by Microsoft or QNAP.
## Vulnerability Description
The vulnerability exists within the Kestrel ASP.NET Core web server, which is installed and depended upon by the QNAP NetBak PC Agent during setup. The flaw concerns HTTP request smuggling that can be leveraged by an attacker with low privileges. Successful exploitation allows the attacker to bypass front-end security controls.
## Exploitation
- Status: Implicitly **vulnerable** to exploitation; Microsoft has already patched the underlying ASP.NET Core component.
- Complexity: Likely **Low to Medium** given the reference to attackers with "low privileges."
- Attack Vector: **Network** (via specially crafted HTTP requests sent to the affected web server component).
## Impact
- Confidentiality: **High** (Could lead to unauthorized access to sensitive data by logging in as another user).
- Integrity: **High** (Could lead to modification of server files or performing injection attacks).
- Availability: **Medium** (Limited denial-of-service conditions possible).
## Remediation
### Patches
- **For ASP.NET Core:** Users must ensure their Windows systems have the latest Microsoft ASP.NET Core updates installed (the underlying fix provided by Microsoft).
- **For NetBak PC Agent Users (Recommended Approach):**
1. Reinstall the NetBak PC Agent application to pull in the latest, corrected ASP.NET Core runtime components.
2. Alternatively, manually download and install the latest **ASP.NET Core Runtime (Hosting Bundle)** from the .NET 8.0 download page.
### Workarounds
- Ensure that systems running NetBak PC Agent have the latest Microsoft ASP.NET Core updates installed, even if the NetBak application itself has not been explicitly updated.
## Detection
- Detection strategies revolve around monitoring for the specific indicators associated with HTTP request smuggling attacks targeting the Kestrel web server.
- Indicators of compromise would include unusually formatted or malformed HTTP requests designed to confuse request boundary parsing mechanisms.
- Detection methods should focus on network traffic inspection for anomalous HTTP headers or content length discrepancies directed toward services utilizing the affected ASP.NET Core runtime.
## References
- Vendor Advisory Link: hXXps://www.qnap.com/en/security-advisory/qsa-25-44
- Vulnerability Details Link (NVD): hXXps://nvd.nist.gov/vuln/detail/CVE-2025-55315
- Related CWE: hXXps://cwe.mitre.org/data/definitions/444.html