Abstract
Multiple reflected Cross-Site scripting vulnerabilities were found in Synology Photo Station. These issues allow attackers to perform a wide variety of actions, such as stealing victims' session tokens or login credentials if available, performing arbitrary actions on their behalf but also performing arbitrary redirects to potential malicious websites.
Tested version
This issue was tested on Synology Photo Station version 6.2-2858.
Fix
Synology reports that this issue has been resolved in Photo Station version 6.3-2945. https://www.synology.com/en-us/releaseNote/PhotoStation
Introduction
Synology Photo Station is an online photo album that is managed by DiskStation Manager (DSM). Synology NAS provides the home/photo folder for storing photos and videos that can be viewed via a web browser. Multiple reflected Cross-Site scripting vulnerabilities were found in Synology Photo Station.
Details
Success parameter of login.php
As shown in the code fragment below of the mobile login.php page, the success request parameter is not HTML encoded (htmlentities) in the point where it is copied into application's response, rendering the Photo Station mobile login page vulnerable to reflected Cross-Site Scripting.
if (isSet($_GET['success'])) {
$smarty->assign('alertMsg', **$_GET['success'])**;
}
The following proof of concept demonstrates this issue:
http://
URL parameters of index.php
The code fragment below shows that URL parameters are not HTML encoded when they are used into application's response, rendering the Photo Station pages vulnerable to reflected Cross-Site Scripting.
function FormData($data, $url)
{
$urlPrefix = csSYNOPhotoMisc::GetServerHost().SYNOPHOTO_URL_PREFIX;
return array(
'type' => htmlspecialchars($data['type']),
'title' => htmlspecialchars($data['title']),
'description' => htmlspecialchars($data['desc']),
'img' => ** $urlPrefix . $data['img'] **,
'url' => ** $urlPrefix . $url **
);
}
Tricking a victim into visiting a specially crafted URL allows attackers to run arbitrary client-side scripting code within the victim's browser. The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials if available, performing arbitrary actions on their behalf but also performing arbitrary redirects to potential malicious websites.
The following proof of concept demonstrates this issue:
http://