exploit the possibilities

Synology.com Cross Site Scripting

Synology.com Cross Site Scripting
Posted Apr 3, 2015
Authored by Yann CAM

Synology.com suffered from a cross site scripting vulnerability.

tags | exploit, xss
MD5 | 58d9842618821e93c78f24b0f7f0e603

Synology.com Cross Site Scripting

Change Mirror Download
######################################################################
# Exploit Title: Synology.com sub-domain OAuth exchange Reflected XSS (RXSS)
# Date: 03/04/2014
# Author: Yann CAM @ Synetis - ASafety
# Vendor or Software Link: www.synology.com
# Version: /
# Category: Reflected Cross Site Scripting
# Google dork:
# Tested on: Synology.com update sub-domain
######################################################################

Synology description :
======================================================================

Synology Inc., is a Taiwanese corporation that specializes in network attached storage (NAS) appliances. Synology’s line of NAS are known as the DiskStation for
desktop models, and RackStation for rack-mount models. Synology's products are distributed worldwide and localized in several languages. Synology's headquarters
are located in Taipei, Taiwan with subsidiaries located around the world.


Vulnerability description :
======================================================================

A reflected XSS is available in the update.synology.com sub-domain.
Through this vulnerability, an attacker could tamper with page rendering, redirect victims to fake Synology portals, or capture Synology's users credentials such cookies.
It's also possible to interact with the OAuth authentication protocol scenario where the vulnerability is located.
This reflected XSS is on GET "state" variable and is not properly sanitized before being used to his page.


Proof of Concept :
======================================================================

A non-persistent XSS (RXSS) in "state" GET param is available in the update.synology.com sub-domain during OAuth CloudSync process.
Tested on Firefox 33.1.1.

If the CloudSync package is deployed in the DSM, it's possible to attach some public clouds to synchronized them with the NAS.
During the process to attach the public cloud (like DropBox, GoogleDrive, etc.), there is multiple request through the OAuth protocol.

Synology's OAuth page is opened to check the perms of the public cloud. It's possible to inject JavaScript into this context.
With the control of this context, an attacker can catch and control the OAuth exchanges and validation.

PoC:

https://update.synology.com/CloudSync/db.php?state=https%3A%2F%2Fwww.asafety.fr<script>alert('Reflected XSS - Yann CAM @ASafety');</script>&code=pIBf5bHN8zMAAAAAAAABRU0-iCumtCrexU63hCMeguX


Screenshots :
======================================================================

- http://www.asafety.fr/data/20141123-RXSS_synology_synetis_001.png
- http://www.asafety.fr/data/20141123-RXSS_synology_asafety_002.png


Solution:
======================================================================

Fixed by Synology security team.


Additional resources / article and screenshots :
======================================================================

- https://www.synology.com/
- http://www.asafety.fr/vuln-exploit-poc/contribution-synology-injection-de-code-javascript-xss
- http://www.synetis.com


Report timeline :
======================================================================

2014-11-23 : Synology security team alerted with details and PoC.
2014-11-25 : Synology response and ack.
2014-11-26 : Vulnerability confirmed and fixed by Synology security team.
2014-11-26 : ASafety confirms the fix.
2014-11-27 : Synology thanks the confirmation.
2015-04-03 : ASafety public article
2015-04-03 : Public advisory

Credits :
======================================================================

88888888
88 888 88 88
888 88 88
788 Z88 88 88.888888 8888888 888888 88 8888888.
888888. 88 88 888 Z88 88 88 88 88 88 88
8888888 88 88 88 88 88 88 88 88 888
888 88 88 88 88 88888888888 88 88 888888
88 88 88 8. 88 88 88 88 88 888
888 ,88 8I88 88 88 88 88 88 88 .88 .88
?8888888888. 888 88 88 88888888 8888 88 =88888888
888. 88
88 www.synetis.com
8888 Consulting firm in management and information security

Yann CAM - Security Consultant @ Synetis | ASafety

--
SYNETIS | ASafety
CONTACT: www.synetis.com | www.asafety.fr

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

November 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    28 Files
  • 2
    Nov 2nd
    1 Files
  • 3
    Nov 3rd
    1 Files
  • 4
    Nov 4th
    12 Files
  • 5
    Nov 5th
    19 Files
  • 6
    Nov 6th
    65 Files
  • 7
    Nov 7th
    22 Files
  • 8
    Nov 8th
    18 Files
  • 9
    Nov 9th
    1 Files
  • 10
    Nov 10th
    1 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    65 Files
  • 13
    Nov 13th
    27 Files
  • 14
    Nov 14th
    22 Files
  • 15
    Nov 15th
    0 Files
  • 16
    Nov 16th
    0 Files
  • 17
    Nov 17th
    0 Files
  • 18
    Nov 18th
    0 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    0 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    0 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close