TOS 4&5 automatically opens every used port via UPnP

[Kakise]

I noticed a security flaw with TOS 4 and 5. When using a NAS (tested on F2-221), by default, with upnp disabled in TOS, every port is opened through upnp. ftp, ssh, web, ... (even when the services are disabled). I tested and it made the TNAS fully accessible remotely, even with my router's firewall and every remote option in TOS disabled.

I am confident it's not supposed to do that. And if it's supposed to do that, it shouldn't.

[RyanYang]

Hi,
Which two versions of TOS did you use for testing? Did you install it normally after clearing the router's port mapping?
It may have been there because the previous system automatically mapped the external port.

[TMroy]

{L_BUTTON_AT}Kakise

How do you know such ports are opened? do you have a screen shot?

[Kakise]

Hi,
Which two versions of TOS did you use for testing? Did you install it normally after clearing the router's port mapping?
It may have been there because the previous system automatically mapped the external port.

I have tested it on TOS 4.2.30, 4.2.29 and 5.0.55. They were clean installs, I got my nas 3 days ago.

[at=Kakise post_id=17416 time=1647571188 user_id=4853][/at]

How do you know such ports are opened? do you have a screen shot?

I checked the UPnP panel of my router, I disabled UPnP as soon as I noticed the ports were open, because it enabled full remote access to my NAS from http://[my_ip]:[my_port] (I always use a VPN to access my data). It can also be seen on GRC's ShieldsUP tool (https://www.grc.com/shieldsup) by scanning the ports (a UPnP probe will show my IP as being stealth)

Even with the UPnP service of my router disabled AND all of the services manually deleted one by one, you can see that the nas still probes UPnP for my router and tries to open ports ; another weird thing is that it opens port 5443 when I changed the port of TOS :

[titanrx8]

Hi,
Which two versions of TOS did you use for testing? Did you install it normally after clearing the router's port mapping?
It may have been there because the previous system automatically mapped the external port.

I have tested it on TOS 4.2.30, 4.2.29 and 5.0.55. They were clean installs, I got my nas 3 days ago.

[at=Kakise post_id=17416 time=1647571188 user_id=4853][/at]

How do you know such ports are opened? do you have a screen shot?

@kakise How did you run ShieldsUp from your TOS system?
I checked the UPnP panel of my router, I disabled UPnP as soon as I noticed the ports were open, because it enabled full remote access to my NAS from http://[my_ip]:[my_port] (I always use a VPN to access my data). It can also be seen on GRC's ShieldsUP tool (https://www.grc.com/shieldsup) by scanning the ports (a UPnP probe will show my IP as being stealth)

Even with the UPnP service of my router disabled AND all of the services manually deleted one by one, you can see that the nas still probes UPnP for my router and tries to open ports ; another weird thing is that it opens port 5443 when I changed the port of TOS :

[Kakise]

You don't need to run it from your TOS system, you just need to run it from your browser in a browser on the same network, as it will probe your public ip

[TMroy]

From the screen shot, I didn't see the upnp port, all ports listed are the services running on your device.

[Kakise]

From the screen shot, I didn't see the upnp port, all ports listed are the services running on your device.

The screenshot is the UPnP service of my internet router, and it shows that the major service running on TNAS automatically probe UPnP to open the ports outside of the LAN Network. It's a problem specific to TNAS as I have 2 other Linux servers running the same services, on the same VLAN without opening any ports via UPnP.

Basically TOS just opens every port it uses on the router, without being asked to. Out of the box, every services of the NAS is accessible on [my_public_ip] without enabling any sort of remote access functionality.

[titanrx8]

@kakise
How did you run ShieldsUp from your TOS system?

[TMroy]

{L_BUTTON_AT}Kakise

without opening your http/https port and plex port to your router, how can you access your device?