CVE-2013-6955

Related Files

Diskstation Manager 4.3-3810 Data Append / Code Execution

Posted Mar 25, 2014

Authored by tiamat451

webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.

tags | advisory, remote, web, arbitrary, cgi

advisories | CVE-2013-6955, CVE-2013-6987

SHA-256 | d20d6eda27bee2e48fd7dddd353b5841c8f19f449a5657951a591227c486e56e

Download | Favorite | View

Synology DiskStation Manager SLICEUPLOAD Remote Command Execution

Posted Dec 23, 2013

Authored by Markus Wulftange | Site metasploit.com

This Metasploit module exploits a vulnerability found in Synology DiskStation Manager (DSM) versions 4.x, which allows the execution of arbitrary commands under root privileges. The vulnerability is located in /webman/imageSelector.cgi, which allows to append arbitrary data to a given file using a so called SLICEUPLOAD functionality, which can be triggered by an unauthenticated user with a specially crafted HTTP request. This is exploited by this module to append the given commands to /redirect.cgi, which is a regular shell script file, and can be invoked with another HTTP request. Synology reported that the vulnerability has been fixed with versions 4.0-2259, 4.2-3243, and 4.3-3810 Update 1, respectively; the 4.1 branch remains vulnerable.

tags | exploit, web, arbitrary, shell, cgi, root

advisories | CVE-2013-6955

SHA-256 | 513af8fcad7f15ab39a785c35d338137aeacd8422cf292ee059738323ccdea1f

Download | Favorite | View