###################################################################### # Exploit Title: Synology.com sub-domain OAuth exchange Reflected XSS (RXSS) # Date: 03/04/2014 # Author: Yann CAM @ Synetis - ASafety # Vendor or Software Link: www.synology.com # Version: / # Category: Reflected Cross Site Scripting # Google dork: # Tested on: Synology.com update sub-domain ###################################################################### Synology description : ====================================================================== Synology Inc., is a Taiwanese corporation that specializes in network attached storage (NAS) appliances. Synology?s line of NAS are known as the DiskStation for desktop models, and RackStation for rack-mount models. Synology's products are distributed worldwide and localized in several languages. Synology's headquarters are located in Taipei, Taiwan with subsidiaries located around the world. Vulnerability description : ====================================================================== A reflected XSS is available in the update.synology.com sub-domain. Through this vulnerability, an attacker could tamper with page rendering, redirect victims to fake Synology portals, or capture Synology's users credentials such cookies. It's also possible to interact with the OAuth authentication protocol scenario where the vulnerability is located. This reflected XSS is on GET "state" variable and is not properly sanitized before being used to his page. Proof of Concept : ====================================================================== A non-persistent XSS (RXSS) in "state" GET param is available in the update.synology.com sub-domain during OAuth CloudSync process. Tested on Firefox 33.1.1. If the CloudSync package is deployed in the DSM, it's possible to attach some public clouds to synchronized them with the NAS. During the process to attach the public cloud (like DropBox, GoogleDrive, etc.), there is multiple request through the OAuth protocol. Synology's OAuth page is opened to check the perms of the public cloud. It's possible to inject JavaScript into this context. With the control of this context, an attacker can catch and control the OAuth exchanges and validation. PoC: https://update.synology.com/CloudSync/db.php?state=https%3A%2F%2Fwww.asafety.fr<script>alert('Reflected XSS - Yann CAM @ASafety');</script>&code=pIBf5bHN8zMAAAAAAAABRU0-iCumtCrexU63hCMeguX Screenshots : ====================================================================== - http://www.asafety.fr/data/20141123-RXSS_synology_synetis_001.png - http://www.asafety.fr/data/20141123-RXSS_synology_asafety_002.png Solution: ====================================================================== Fixed by Synology security team. Additional resources / article and screenshots : ====================================================================== - https://www.synology.com/ - http://www.asafety.fr/vuln-exploit-poc/contribution-synology-injection-de-code-javascript-xss - http://www.synetis.com Report timeline : ====================================================================== 2014-11-23 : Synology security team alerted with details and PoC. 2014-11-25 : Synology response and ack. 2014-11-26 : Vulnerability confirmed and fixed by Synology security team. 2014-11-26 : ASafety confirms the fix. 2014-11-27 : Synology thanks the confirmation. 2015-04-03 : ASafety public article 2015-04-03 : Public advisory Credits : ====================================================================== 88888888 88 888 88 88 888 88 88 788 Z88 88 88.888888 8888888 888888 88 8888888. 888888. 88 88 888 Z88 88 88 88 88 88 88 8888888 88 88 88 88 88 88 88 88 888 888 88 88 88 88 88888888888 88 88 888888 88 88 88 8. 88 88 88 88 88 888 888 ,88 8I88 88 88 88 88 88 88 .88 .88 ?8888888888. 888 88 88 88888888 8888 88 =88888888 888. 88 88 www.synetis.com 8888 Consulting firm in management and information security Yann CAM - Security Consultant @ Synetis | ASafety -- SYNETIS | ASafety CONTACT: www.synetis.com | www.asafety.fr