DSM的安全问题！4.3及以前版本统统有隐患。

jackygurui

从Xpenology看到的链接。http://www.securityfocus.com/archive/1/528543内容如下，懒得翻译，自己有兴趣的慢慢研究。看似挺严重的。
时间： Sep 10 2013 08:43PM
**************************************************************
Title: Synology DSM multiple vulnerabilities
Version affected: <= 4.3-3776
Vendor: Synology
Discovered by: Andrea Fabrizi
Email: andrea.fabrizi (at) gmail (dot) com [email concealed]
Web: http://www.andreafabrizi.it
Twitter: @andreaf83
Status: unpatched
**************************************************************

Synology DiskStation Manager (DSM) it's a Linux based operating
system, used for the DiskStation and RackStation products.

1] ======== Remote file download ========
Any authenticated user, even with the lowest privilege, can download
any system file, included the /etc/shadow, samba password files and
files owned by the other DSM users, without any restriction.

The vulnerability is located in "/webman/wallpaper.cgi". The CGI takes
as parameter the full path of the image to download, encoded in ASCII
Hex format.
The problem is that any file type can be downloaded (not only images)
and the path validation is very poor. In fact the CGI checks only if
the path starts with an allowed directory (like
/usr/syno/synoman/webman), and this kind of protection can be easily
bypassed using the ../ attack.

For example to access the /etc/shadow:
2f7573722f73796e6f2f73796e6f6d616e2f7765626d616e2f2e2e2f2e2e2f2e2e2f2e2e
2f6574632f736861646f77
(/usr/syno/synoman/webman/../../../../etc/shadow)

------------------------------------------
GET /webman/wallpaper.cgi?path=AABBCCDDEEFF11223344 HTTP/1.1
Host: 127.0.0.1:5000
Cookie: stay_login=0; id=XXXXXXXXXXX
------------------------------------------

2] ======== Command injection ========
A command injection vulnerability, present on the
"/webman/modules/ControlPanel/ modules/externaldevices.cgi" CGI,
allows any administrative user to execute arbitrary commands on the
system, with root privileges.

------------------------------------------
POST /webman/modules/ControlPanel/modules/externaldevices.cgi HTTP/1.1
Host: 127.0.0.1:5000
User-Agent: ls
Cookie: stay_login=0; id=XXXXXXXXXXX
Content-Length: 128

action=apply&device_name=aa&printerid=1.1.1.1-aa';$HTTP_USER_AGENT>/tmp/
output+%23&printer_mode=netPrinter&eject_netprinter=true
------------------------------------------

Putting the command to execute as the User Agent string, after the
request the output will be ready into the /tmp/output file.

3] ======== Partial remote content download ========
For the localization DSM uses some CGI, that takes the lang parameter
(e.g. "enu" for english) and returns a Json object containing the
localized strings in a dictionary format.

The strings are taken from a local file with the following path:
[current_dir]/texts/[lang_parameter_value]/strings

The "/strings" appended at the end of the path prevents a path
injection, because any value injected using the "lang" parameter will
be invalidated (in other words, it's possible to read only files named
"strings"). But, the interesting thing is that the full path of the
strings files is built using a snprintf function like that:

snprintf(&s, 0x80u, "texts/%s/strings", lang)

This means that putting a lang value big enough, it's possible to
overflow the 128 byte allowed by the snprintf and take out the
"/strings" from the built path.

For example, the lang value
"./////////////////////////////////////////////////////////////////////
///////////////////../../../../../etc/synoinfo.conf" allow to get the
/etc/synoinfo.conf file content.

The second problem is that the input file taken by the CGI must be
formatted in a key/value way: key1=string1

In other words, to get some content from a generic file it's necessary
that the file contains at least an "=" for each line (this is the
reason why I called the vulnerability "Partial remote content
download").

At first glance it may seems very limiting, but, seen that it's
possible to read directly from the disk block device (e.g.
/dev/vg1000/lv), the amount of data dumped is very huge. In my tests I
was able to dump around the 25/30% of the drive (tested with mixed
content, like documents, images, generic files). It's possible to dump
data from any drive connected. Interesting data can be also dumped
from the /proc vfs.

This vulnerability impacts two different CGI and is exploitable
without authentication by any remote user:

/scripts/uistrings.cgi
/webfm/webUI/uistrings.cgi

------------------------------------------
GET /scripts/uistrings.cgi?lang=XXXXXXXXX HTTP/1.1
Host: 127.0.0.1:5000
------------------------------------------

In the system there are two other uistrings.cgi, but are not affected.

4] XSS
A classic Cross-site scripting affects the following CGI:
/webman/info.cgi?host=XXXX&target=XXXX&add=XXXX

yht2002

鸟语，看不懂

smcsdk

yht2002 发表于 2013-9-18 07:41
鸟语，看不懂

google翻一下看啊，应该也就差不多看懂了！！！

ilovepl

google翻一下去。

windowsxp

洋文啊。。。。。

morning_2001

所以现在攒丝瓜等4.3  估计到时也还会有4.4之前都有隐患之说

alfred

看起来有点累。。。坐等翻译

nizhengfeng

感谢分享

hacking2000

看不懂，严重吗？

hsl667

怎办啊

cmac2007

慢慢看下文

晓李匪盗

黑群只有4.2啊

js3000

这非常严重，有点都看不懂，太严重了。要学学鸟语了。

roycity

学习学习,谢谢分享!

linux147

看到标题进来的，，，，没看明白1

karl

低級漏洞...
對DSM太失望了

aka

比较感兴趣

jackygurui

问题确实有点低级。。失望。

wuchsn

学习学习,谢谢分享!

wm1245

看一下，学习。。