Synology Photo Station 6.2-2858 Cross Site Scripting

`------------------------------------------------------------------------  
Synology Photo Station multiple Cross-Site Scripting vulnerabilities  
------------------------------------------------------------------------  
Han Sahin, May 2015  
  
------------------------------------------------------------------------  
Abstract  
------------------------------------------------------------------------  
Multiple reflected Cross-Site scripting vulnerabilities were found in  
Synology Photo Station. These issues allow attackers to perform a wide  
variety of actions, such as stealing victims' session tokens or login  
credentials if available, performing arbitrary actions on their behalf  
but also performing arbitrary redirects to potential malicious websites.  
  
------------------------------------------------------------------------  
Tested version  
------------------------------------------------------------------------  
This issue was tested on Synology Photo Station version 6.2-2858.  
  
------------------------------------------------------------------------  
Fix  
------------------------------------------------------------------------  
Synology reports that this issue has been resolved in Photo Station  
version 6.3-2945.  
https://www.synology.com/en-us/releaseNote/PhotoStation  
  
------------------------------------------------------------------------  
Details  
------------------------------------------------------------------------  
https://www.securify.nl/advisory/SFY20150504/synology_photo_station_multiple_cross_site_scripting_vulnerabilities.html  
  
Success parameter of login.php  
  
As shown in the code fragment below of the mobile login.php page, the success request parameter is not HTML encoded (htmlentities) in the point where it is copied into application's response, rendering the Photo Station mobile login page vulnerable to reflected Cross-Site Scripting.  
  
if (isSet($_GET['success'])) {  
$smarty->assign('alertMsg', $_GET['success']);  
}  
  
The following proof of concept demonstrates this issue:  
http://<target>/photo/m/login.php?success=Reflected:%3Cscript%3Ealert%28document.cookie%29%3C/script%3E  
URL parameters of index.php  
  
The code fragment below shows that URL parameters are not HTML encoded when they are used into application's response, rendering the Photo Station pages vulnerable to reflected Cross-Site Scripting.  
  
function FormData($data, $url)  
{  
$urlPrefix = csSYNOPhotoMisc::GetServerHost().SYNOPHOTO_URL_PREFIX;  
  
return array(  
'type' => htmlspecialchars($data['type']),  
'title' => htmlspecialchars($data['title']),  
'description' => htmlspecialchars($data['desc']),  
'img' => $urlPrefix . $data['img'] ,  
'url' => $urlPrefix . $url  
);  
}  
  
Tricking a victim into visiting a specially crafted URL allows attackers to run arbitrary client-side scripting code within the victim's browser. The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials if available, performing arbitrary actions on their behalf but also performing arbitrary redirects to potential malicious websites.  
  
The following proof of concept demonstrates this issue:  
http://<target>/photo/?t="><IFRAME>  
`