Web commands injection through FTP Login in Synology Disk Station - CVE-2010-2453

[Rodrigo Branco <rbranco@xxxxxxxxxxxxxx>]

Check Point Software Technologies - Vulnerability Discovery Team (VDT)
http://www.checkpoint.com/defense/

Web commands injection through FTP Login in Synology Disk Station
CVE-2010-2453


INTRODUCTION

Synology Inc develops high-performance, reliable, versatile, and 
environmentally-friendly Network Attached Storage (NAS) products. Synology's 
goal 
is to deliver user-friendly storage solutions and solid customer service to 
satisfy the needs of businesses, home offices, individual users and 
families.

The disk station product provided by Synology as Network Attached Storage is 
vulnerable to multiple vulnerabilities including the possibility of 
remote command execution via CSRF (Cross Site Request Forging) through FTP 
login console. The FTP server is provided as a configurable service 
through web interface which provides backend access to manage the disks 
station. The problem occurs in the FTP logging mechanism together with the 
admin interface used to view those logs. The FTP console input in the form 
username and password gets logged in the web application interface. 

This problem was confirmed in the following versions of Synology Disk Station, 
other versions may be also affected.

Synology Disk Station 2.x

Synology issued an update for this vulnerability in the release DSM3.0-1337.


CVSS Scoring System

The CVSS score is: 9.5
        Base Score: 10
        Temporal Score: 9.5
We used the following values to calculate the scores:
        Base score is: AV:N/AC:L/Au:N/C:C/I:C/A:C
        Temporal score is: E:F/RL:U/RC:C


DETAILS


There are four steps for exploitation, specified here together with the 
identified problem:

        1. The attacker can inject malicious input from the FTP login console. 
As the authentication credentials are inappropriate the FTP authentication 
        module generates error and the requisite input is logged in to the web 
interface of the disk station.
        2. Secondly the FTP logging module is not designed appropriately and 
the content comes from the FTP login console is directly placed into the log 
        window without verification of the Content-Type parameter. The content 
is allowed to be rendered as HTML, Script etc. An attacker can inject 
        malicious HTML tags, DOM calls, third part y scripts, CSRF calls that 
gets executed in the context of logged in account which is administering it.
        3. Usually log mechanism is handled by the admin account. The chances 
of code execution and injection fulfillment are high within full privileges 
        as of administrator. So any code injected by the attacker becomes 
persistent in most of the cases and remain there for execution. Moreover CSRF 
        code with malicious calls can be executed without user interaction.
        4. Attacker has to be well versed in directory structure of the disk 
station manager so that injections can be made according to that and further 
        operations can be performed. The FTP servers accept username string 
upto 80-100 characters which is good enough to craft injections to get the 
        things done The scripts can be inserted from local domain or LAN or 
third party source to inject arbitrary code.

C:\Users\Administrator>ftp example.com
Connected to example.com.
220 Disk Station FTP server at DiskStation ready.
User (example.com:(none)): "/><script>alert("Check Point VDT"</script>
331 Password required for "/><script>alert("Check Point VDT"</script>
Password:
530 Login incorrect.
Login failed.
ftp> Invalid command.
ftp> bye
421 Timeout (300 seconds): closing control connection.

In order to determine the size of the allowed input string, we can do:

C:\Users\Administrator>ftp example.com
Connected to example.com.
220 Disk Station FTP server at DiskStation ready.
User (example.com:(none)): 
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
 -> Our input
331 Password required for 
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA. 
-> The total lenght really used
Password:
530 Login incorrect.
Login failed.
ftp> Invalid command.
ftp> bye
421 Timeout (300 seconds): closing control connection.



CREDITS

This vulnerability was discovered and researched by Rodrigo Rubira Branco from 
Check Point Vulnerability Discovery Team (VDT) and Aditya
K. Sood from Secniche.



Best Regards,
 
Rodrigo.
 
--
Rodrigo Rubira Branco
Senior Security Researcher
Vulnerability Discovery Team (VDT)
Check Point Software Technologies