CVE-2024-0854: Synology DSM Open Redirect Vulnerability

CVE-2024-0854 Overview

CVE-2024-0854 is an open redirect vulnerability in the file access component of Synology DiskStation Manager (DSM). This flaw allows remote authenticated users to redirect victims to untrusted external sites, enabling phishing attacks through unspecified vectors. The vulnerability affects multiple DSM versions and can be exploited to trick users into visiting malicious websites that may harvest credentials or deliver malware.

Critical Impact

Authenticated attackers can leverage this open redirect vulnerability to conduct convincing phishing campaigns against users of affected Synology NAS devices, potentially leading to credential theft or malware distribution.

Affected Products

• Synology DiskStation Manager before version 6.2.4-25556-8
• Synology DiskStation Manager before version 7.0.1-42218-7
• Synology DiskStation Manager before version 7.1.1-42962-7
• Synology DiskStation Manager before version 7.2.1-69057-2

Discovery Timeline

• 2024-01-24 - CVE-2024-0854 published to NVD
• 2025-01-14 - Last updated in NVD database

Technical Details for CVE-2024-0854

Vulnerability Analysis

This vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site), commonly referred to as an open redirect. The flaw exists within the file access component of Synology DiskStation Manager, where improper validation of URL parameters allows authenticated users to craft malicious links that redirect victims to attacker-controlled websites.

Open redirect vulnerabilities are particularly dangerous because they abuse the trust users place in legitimate domains. When a victim clicks a link that appears to originate from their trusted Synology NAS, they may unknowingly be redirected to a phishing site designed to harvest their credentials or deliver malicious payloads.

The vulnerability requires authentication, meaning an attacker must have valid credentials to the DSM system to craft the malicious redirect URL. However, once crafted, the malicious link can be distributed to other users who trust URLs originating from the Synology device.

Root Cause

The root cause of CVE-2024-0854 is insufficient validation of redirect URLs in the file access component of DSM. The application fails to properly verify that redirect destinations are within trusted domains before performing the redirection. This allows authenticated users to specify arbitrary external URLs as redirect targets, bypassing the intended security boundary.

Attack Vector

The attack vector for this vulnerability is network-based and requires the attacker to be authenticated to the DSM instance. The typical attack flow involves:

1. An authenticated attacker identifies the vulnerable file access component endpoint
2. The attacker crafts a URL containing a redirect parameter pointing to a malicious external site
3. The malicious URL is distributed to potential victims through phishing emails, messages, or other social engineering methods
4. When a victim clicks the link, they are first directed to the legitimate Synology DSM server
5. The DSM server then redirects the victim to the attacker-controlled malicious site
6. The victim, trusting the initial Synology domain, may be more susceptible to entering credentials or downloading malware from the redirected site

The attack mechanism exploits the trust relationship between users and their Synology NAS device, making phishing attempts more convincing and effective.

Detection Methods for CVE-2024-0854

Indicators of Compromise

• Unusual outbound redirects from DSM file access endpoints to external domains
• DSM access logs showing requests with suspicious redirect parameters containing external URLs
• User reports of unexpected redirections when accessing file links from DSM
• Phishing emails or messages containing links to DSM with unusual query parameters

Detection Strategies

• Monitor web server logs for file access component requests containing external URL redirect parameters
• Implement web application firewall (WAF) rules to flag requests with redirect parameters pointing to non-whitelisted domains
• Enable and review DSM audit logs for unusual access patterns from authenticated users
• Deploy endpoint detection to identify users being redirected from DSM to known phishing or malicious domains

Monitoring Recommendations

• Configure alerting for DSM access logs showing redirect requests to external domains
• Implement URL filtering and monitoring for traffic originating from DSM servers
• Review authentication logs for accounts that may have been used to craft malicious redirect links
• Set up security information and event management (SIEM) rules to correlate DSM redirect events with known phishing indicators

How to Mitigate CVE-2024-0854

Immediate Actions Required

• Update Synology DiskStation Manager to the patched versions: 6.2.4-25556-8, 7.0.1-42218-7, 7.1.1-42962-7, or 7.2.1-69057-2 or later
• Review DSM access logs for evidence of exploitation attempts
• Educate users about the risks of clicking links that redirect through DSM to external sites
• Consider implementing network-level URL filtering to block known malicious redirect destinations

Patch Information

Synology has released security patches addressing this vulnerability. Administrators should update to the following minimum versions based on their DSM branch:

• DSM 6.x: Update to version 6.2.4-25556-8 or later
• DSM 7.0.x: Update to version 7.0.1-42218-7 or later
• DSM 7.1.x: Update to version 7.1.1-42962-7 or later
• DSM 7.2.x: Update to version 7.2.1-69057-2 or later

For complete details, refer to the Synology Security Advisory SA-24-02.

Workarounds

• Restrict network access to DSM to trusted networks and users only
• Implement strict URL filtering at the network perimeter to block redirects to untrusted domains
• Enable two-factor authentication for all DSM user accounts to limit attacker access
• Disable or restrict access to the file access component if not required for operations

# Example: Restrict DSM access to specific IP ranges via firewall
# Add these rules to your network firewall or DSM firewall settings
# Replace 192.168.1.0/24 with your trusted network range

# Block external access to DSM ports
iptables -A INPUT -p tcp --dport 5000 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5001 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5000 -j DROP
iptables -A INPUT -p tcp --dport 5001 -j DROP