From XSS to Root on Your Home NAS
Tony Martin demonstrates exploiting stored cross-site scripting in Network Attached Storage (NAS) web interfaces to gain unauthenticated root shell access.
Summary
The Growing Threat Surface of Consumer NAS Devices
Home Network Attached Storage (NAS) units frequently run feature-rich Linux distributions exposing vulnerable web administration portals to local networks and the internet.
Discovering Stored Cross-Site Scripting Vulnerabilities
Tony Martin analyzes web management portals across multiple consumer NAS vendors, identifying input sanitization failures in file management views.
Chaining XSS with Local Privilege Escalation
Martin demonstrates weaponizing client-side XSS to issue authenticated API commands, bypass sudo restrictions, and execute arbitrary root binaries on the host.
Hardening Embedded Web Portals
The author outlines essential remediation strategies—including strict Content Security Policies (CSP), tokenized API validation, and process privilege separation.
Related talks
Main Stage·44 min
Noam Moshe · Sharon Brizinov
Claroty Team82 reveals how cloud connectivity features in Western Digital and Synology NAS devices allow remote compromise and full RCE across millions of devices.
Briefings·37 min
Gal Elbaz · Avi Lumelsky · Uri Katz
Since its introduction in 2010, AirPlay has transformed the way Apple users stream media.
Village Interviews·1 min
A tour of the IoT Village at DEF CON 32 exploring hands-on router hacking, connected device vulnerability research, and zero-day labs.