PT-2013-6222 · Synology · Synology Diskstation Manager

Andrea Fabrizi · Published 2013-12-31 · Updated 2025-01-14 · CVE-2013-6987

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager (DSM) versions prior to 4.3-3810 Update 3

Description Multiple directory traversal vulnerabilities in the FileBrowser components allow remote attackers to read, write, and delete arbitrary files via a .. (dot dot) in the path parameter to "file delete.cgi" or folder path parameter to "file share.cgi" in "webapi/FileStation/"; the dlink parameter to "fbdownload/"; or unspecified parameters to "html5 upload.cgi", "file download.cgi", "file sharing.cgi", "file MVCP.cgi", or "file rename.cgi" in "webapi/FileStation/".

Recommendations For versions prior to 4.3-3810 Update 3, update to version 4.3-3810 Update 3 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable "webapi/FileStation/" endpoints until a patch is available. Avoid using the path and folder path parameters in the affected API endpoints until the issue is resolved. Restrict access to the fbdownload/ endpoint to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2013-6987

Affected Products

Synology Diskstation Manager

References · 10

• 🔥 http://packetstormsecurity.com/files/124563 · Exploit
• 🔥 https://exploit-db.com/exploits/30475 · Exploit
• 🔥 http://securityfocus.com/bid/64483 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2013/Dec/177 · Exploit
• 🔥 http://exploit-db.com/exploits/30475 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-6987 · Security Note
• http://synology.com/en-us/releaseNote/model/DS114 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89892 · Note
• https://t.me/cvenotify/107334 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6987 · Note