what you don't know can hurt you

Synology.com Cross Site Scripting

Synology.com Cross Site Scripting
Posted Apr 3, 2015
Authored by Yann CAM

Synology.com suffered from a cross site scripting vulnerability.

tags | exploit, xss
MD5 | 58d9842618821e93c78f24b0f7f0e603

Synology.com Cross Site Scripting

Change Mirror Download
######################################################################
# Exploit Title: Synology.com sub-domain OAuth exchange Reflected XSS (RXSS)
# Date: 03/04/2014
# Author: Yann CAM @ Synetis - ASafety
# Vendor or Software Link: www.synology.com
# Version: /
# Category: Reflected Cross Site Scripting
# Google dork:
# Tested on: Synology.com update sub-domain
######################################################################

Synology description :
======================================================================

Synology Inc., is a Taiwanese corporation that specializes in network attached storage (NAS) appliances. Synology’s line of NAS are known as the DiskStation for
desktop models, and RackStation for rack-mount models. Synology's products are distributed worldwide and localized in several languages. Synology's headquarters
are located in Taipei, Taiwan with subsidiaries located around the world.


Vulnerability description :
======================================================================

A reflected XSS is available in the update.synology.com sub-domain.
Through this vulnerability, an attacker could tamper with page rendering, redirect victims to fake Synology portals, or capture Synology's users credentials such cookies.
It's also possible to interact with the OAuth authentication protocol scenario where the vulnerability is located.
This reflected XSS is on GET "state" variable and is not properly sanitized before being used to his page.


Proof of Concept :
======================================================================

A non-persistent XSS (RXSS) in "state" GET param is available in the update.synology.com sub-domain during OAuth CloudSync process.
Tested on Firefox 33.1.1.

If the CloudSync package is deployed in the DSM, it's possible to attach some public clouds to synchronized them with the NAS.
During the process to attach the public cloud (like DropBox, GoogleDrive, etc.), there is multiple request through the OAuth protocol.

Synology's OAuth page is opened to check the perms of the public cloud. It's possible to inject JavaScript into this context.
With the control of this context, an attacker can catch and control the OAuth exchanges and validation.

PoC:

https://update.synology.com/CloudSync/db.php?state=https%3A%2F%2Fwww.asafety.fr<script>alert('Reflected XSS - Yann CAM @ASafety');</script>&code=pIBf5bHN8zMAAAAAAAABRU0-iCumtCrexU63hCMeguX


Screenshots :
======================================================================

- http://www.asafety.fr/data/20141123-RXSS_synology_synetis_001.png
- http://www.asafety.fr/data/20141123-RXSS_synology_asafety_002.png


Solution:
======================================================================

Fixed by Synology security team.


Additional resources / article and screenshots :
======================================================================

- https://www.synology.com/
- http://www.asafety.fr/vuln-exploit-poc/contribution-synology-injection-de-code-javascript-xss
- http://www.synetis.com


Report timeline :
======================================================================

2014-11-23 : Synology security team alerted with details and PoC.
2014-11-25 : Synology response and ack.
2014-11-26 : Vulnerability confirmed and fixed by Synology security team.
2014-11-26 : ASafety confirms the fix.
2014-11-27 : Synology thanks the confirmation.
2015-04-03 : ASafety public article
2015-04-03 : Public advisory

Credits :
======================================================================

88888888
88 888 88 88
888 88 88
788 Z88 88 88.888888 8888888 888888 88 8888888.
888888. 88 88 888 Z88 88 88 88 88 88 88
8888888 88 88 88 88 88 88 88 88 888
888 88 88 88 88 88888888888 88 88 888888
88 88 88 8. 88 88 88 88 88 888
888 ,88 8I88 88 88 88 88 88 88 .88 .88
?8888888888. 888 88 88 88888888 8888 88 =88888888
888. 88
88 www.synetis.com
8888 Consulting firm in management and information security

Yann CAM - Security Consultant @ Synetis | ASafety

--
SYNETIS | ASafety
CONTACT: www.synetis.com | www.asafety.fr
Login or Register to add favorites

File Archive:

December 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    22 Files
  • 2
    Dec 2nd
    33 Files
  • 3
    Dec 3rd
    16 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close