Insecure Direct Object Reference (IDOR) in /nasapi allows user enumeration

Summary

A vulnerability in the /nasapi endpoint of Buffalo NAS devices allows unauthenticated or guest-level users to enumerate valid usernames and their associated privilege roles.

Affected Supported TeraStations
All NAS products
 

Impact:
The following information can be obtained:
Username, User ID, Category, Role, Description, Quota, Groups, Primary Group
 

Recommended Action:
To mitigate this risk immediately, it is highly recommended to disable the guest user account. This prevents unauthenticated users from accessing the /nasapi endpoint used to trigger the enumeration.
 

Back to Security Notices