Overview
A critical Cross-Site Request Forgery (CSRF) vulnerability, identified as CVE-2024-45538, has been discovered in the WebAPI Framework within Synology DiskStation Manager (DSM) and Synology Unified Controller (DSMUC). This vulnerability allows remote attackers to potentially execute arbitrary code on affected devices. It is crucial to update your systems immediately to mitigate this risk.
Technical Details
CVE-2024-45538 affects the following Synology products:
- Synology DiskStation Manager (DSM) versions before 7.2.1-69057-2 and 7.2.2-72806
- Synology Unified Controller (DSMUC) versions before 3.1.4-23079
The vulnerability resides in the WebAPI Framework. Due to insufficient CSRF protection, an attacker can potentially trick a logged-in administrator into unknowingly executing malicious requests. The exact vectors used for code execution are currently unspecified, highlighting the importance of immediate patching.
CVSS Analysis
The Common Vulnerability Scoring System (CVSS) provides a standardized way to assess the severity of security vulnerabilities. CVE-2024-45538 has been assigned the following score:
- CVSS Score: 9.6 (Critical)
This high score reflects the significant risk posed by this vulnerability. A successful exploit could grant an attacker complete control over the affected Synology device.
Possible Impact
A successful exploitation of CVE-2024-45538 could have severe consequences, including:
- Remote Code Execution: Attackers can execute arbitrary code on the affected device, potentially gaining full control.
- Data Breach: Sensitive data stored on the device could be compromised.
- System Compromise: The entire Synology device could be compromised and used for malicious purposes, such as participating in botnets or hosting malicious content.
- Denial of Service: Attackers could disrupt the normal operation of the device, causing a denial of service.
Mitigation and Patch Steps
The primary mitigation step is to update your Synology DSM or DSMUC to the latest versions. Follow these steps:
- DSM: Upgrade to version 7.2.1-69057-2 or later, or version 7.2.2-72806 or later.
- DSMUC: Upgrade to version 3.1.4-23079 or later.
You can update your system through the Synology DSM/DSMUC web interface. Navigate to Control Panel > Update & Restore > DSM Update (or equivalent for DSMUC) and follow the on-screen instructions.
In addition to patching, consider these general security best practices:
- Enable Two-Factor Authentication (2FA) for all user accounts.
- Use strong and unique passwords.
- Regularly review and update your security settings.
- Monitor your system logs for suspicious activity.
References
- Synology Security Advisory: https://www.synology.com/en-global/security/advisory/Synology_SA_24_27
