PT-2020-16753 · Synology · Synology Safeaccess

Published 2020-11-30 · Updated 2022-04-12 · CVE-2020-27660

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Synology SafeAccess versions prior to 1.2.3-0234

Description The issue allows remote attackers to execute arbitrary SQL commands via the domain parameter in request.cgi. This enables attackers to manipulate database queries, potentially leading to unauthorized data access or modification.

Recommendations For Synology SafeAccess versions prior to 1.2.3-0234, update to version 1.2.3-0234 or later to resolve the issue. As a temporary workaround, consider restricting access to the request.cgi module to minimize the risk of exploitation. Avoid using the domain parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-27660

Affected Products

Synology Safeaccess

References · 8

• 🔥 https://github.com/thomasfady/Synology_SA_20_25 · Exploit
• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1087 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-27660 · Security Note
• https://synology.com/security/advisory/Synology_SA_20_25 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27660 · Vendor Advisory
• https://t.me/cibsecurity/16925 · Telegram Post
• https://t.me/cvenotify/6330 · Telegram Post
• https://t.me/cvenotify/7589 · Telegram Post