CVE-2021-28799

What is QNAP HBS 3?

QNAP Network Attached Storage (NAS) devices are widely deployed by small businesses, enterprises, and home users for network file storage, backup, media serving, and data management. HBS 3 (Hybrid Backup Sync) is QNAP's integrated backup, restore, and synchronization application installed by default on QTS-based QNAP NAS systems. HBS 3 manages backup jobs to cloud services (Amazon S3, Google Drive, Azure) and to remote RTRR/rsync destinations. Because QNAP NAS devices often store business-critical data and are configured with remote access enabled for off-site backup management, they are prime ransomware targets — compromising HBS 3 grants both data access and backup manipulation capabilities.

Overview

CVE-2021-28799 is an improper authorization vulnerability (CWE-285) in QNAP's HBS 3 Hybrid Backup Sync application. The vulnerability allows a remote unauthenticated attacker to log in to the QNAP NAS device, bypassing normal authentication controls. Once authenticated, the attacker has full access to the NAS file system and management interface. The Qlocker ransomware group exploited this vulnerability in a massive campaign starting April 19, 2021 — before QNAP published its advisory — encrypting the contents of thousands of QNAP devices worldwide using 7-Zip archive password protection. Victims received ransom demands of 0.01 Bitcoin (~$500 USD at the time). Qlocker generated an estimated $260,000+ in ransoms during the brief campaign.

Affected Versions

Technical Details

The HBS 3 application exposes management endpoints that process login and authentication requests. The authorization check for these endpoints contains a flaw that can be bypassed:

• Root cause: Improper authorization (CWE-285) in HBS 3's authentication logic — the application does not properly verify the identity and authorization of incoming requests, allowing unauthenticated access to authenticated endpoints
• Bypass mechanism: The authentication bypass allows remote attackers to establish a session as an authenticated user without providing valid credentials
• Post-authentication access: Once authenticated, the attacker has NAS administrator-level access including file system access, backup job management, and the ability to run arbitrary commands
• Scope: Changed — the NAS file system serves networked clients; access to the NAS can enable lateral movement to connected systems and access to files from many users' machines
• Qlocker technique: After authentication, Qlocker used legitimate 7-Zip functionality to move all NAS files into password-protected archives, then deleted the originals, effectively ransoming the data without deploying traditional malware

Discovery

The vulnerability was identified in the context of the April 2021 Qlocker ransomware campaign. QNAP published an emergency advisory and released patches on April 22, 2021, after the campaign had already encrypted thousands of devices.

Exploitation Context

The Qlocker campaign was notable for its scale and efficiency — thousands of QNAP devices were encrypted within days using a relatively simple ransomware technique that leveraged QNAP's own built-in 7-Zip functionality rather than custom malware. This made detection difficult as the encryption process appeared to be legitimate system activity. eCh0raix (QNAPCrypt) ransomware operators also exploited this vulnerability in more targeted attacks against business QNAP deployments. QNAP NAS devices frequently have remote access enabled (via myQNAPcloud or direct port forwarding) for backup and media access, exposing HBS 3 management interfaces directly to the internet.

Remediation

1. Update HBS 3 Hybrid Backup Sync to version 16.0.0415 or later via the QNAP App Center immediately
2. Also apply all available QTS firmware updates — multiple QNAP vulnerabilities were exploited in the 2021 Qlocker campaign
3. Disable unnecessary remote access features: disable UPnP port forwarding, remove direct port-forwards to the NAS management interface
4. If the NAS must be remotely accessible, access it through a VPN rather than exposing the management interface directly to the internet
5. Check for and remove .7z archives created by unauthorized processes — Qlocker victims found their files replaced by password-protected 7-Zip archives
6. Review QNAP access logs for unexpected login events, particularly during April–May 2021 if the device was unpatched during that period
7. Enable QNAP Security Counselor to monitor for new vulnerabilities and suspicious activity