Home / exploits Synology Photo Station 6.2-2858 Cross Site Scripting
Posted on 26 May 2015
------------------------------------------------------------------------ Synology Photo Station multiple Cross-Site Scripting vulnerabilities ------------------------------------------------------------------------ Han Sahin, May 2015 ------------------------------------------------------------------------ Abstract ------------------------------------------------------------------------ Multiple reflected Cross-Site scripting vulnerabilities were found in Synology Photo Station. These issues allow attackers to perform a wide variety of actions, such as stealing victims' session tokens or login credentials if available, performing arbitrary actions on their behalf but also performing arbitrary redirects to potential malicious websites. ------------------------------------------------------------------------ Tested version ------------------------------------------------------------------------ This issue was tested on Synology Photo Station version 6.2-2858. ------------------------------------------------------------------------ Fix ------------------------------------------------------------------------ Synology reports that this issue has been resolved in Photo Station version 6.3-2945. https://www.synology.com/en-us/releaseNote/PhotoStation ------------------------------------------------------------------------ Details ------------------------------------------------------------------------ https://www.securify.nl/advisory/SFY20150504/synology_photo_station_multiple_cross_site_scripting_vulnerabilities.html Success parameter of login.php As shown in the code fragment below of the mobile login.php page, the success request parameter is not HTML encoded (htmlentities) in the point where it is copied into application's response, rendering the Photo Station mobile login page vulnerable to reflected Cross-Site Scripting. if (isSet($_GET['success'])) { $smarty->assign('alertMsg', $_GET['success']); } The following proof of concept demonstrates this issue: http://<target>/photo/m/login.php?success=Reflected:%3Cscript%3Ealert%28document.cookie%29%3C/script%3E URL parameters of index.php The code fragment below shows that URL parameters are not HTML encoded when they are used into application's response, rendering the Photo Station pages vulnerable to reflected Cross-Site Scripting. function FormData($data, $url) { $urlPrefix = csSYNOPhotoMisc::GetServerHost().SYNOPHOTO_URL_PREFIX; return array( 'type' => htmlspecialchars($data['type']), 'title' => htmlspecialchars($data['title']), 'description' => htmlspecialchars($data['desc']), 'img' => $urlPrefix . $data['img'] , 'url' => $urlPrefix . $url ); } Tricking a victim into visiting a specially crafted URL allows attackers to run arbitrary client-side scripting code within the victim's browser. The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials if available, performing arbitrary actions on their behalf but also performing arbitrary redirects to potential malicious websites. The following proof of concept demonstrates this issue: http://<target>/photo/?t="><IFRAME>
