CVE-2024-29228 Overview
CVE-2024-29228 is a missing authorization vulnerability in the GetStmUrlPath webapi component of Synology Surveillance Station. The flaw affects Surveillance Station versions before 9.2.0-9289 and 9.2.0-11289 running on Synology DiskStation Manager (DSM) 6.2, 7.1, and 7.2. Remote authenticated users can obtain sensitive information through unspecified vectors. The weakness is classified as [CWE-862] Missing Authorization. Synology addressed the issue in security advisory Synology_SA_24_04.
Critical Impact
Authenticated attackers on the network can read sensitive Surveillance Station data because the GetStmUrlPath endpoint fails to enforce authorization checks, exposing video stream references and related metadata across privilege boundaries.
Affected Products
- Synology Surveillance Station before 9.2.0-9289
- Synology Surveillance Station before 9.2.0-11289
- Synology DiskStation Manager (DSM) 6.2, 7.1, and 7.2
Discovery Timeline
- 2024-03-28 - CVE-2024-29228 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-29228
Vulnerability Analysis
The vulnerability resides in the GetStmUrlPath webapi handler within Synology Surveillance Station. The endpoint returns stream URL path data but does not validate whether the requesting user is authorized to access the referenced resource. Any authenticated user on the network can invoke the API and receive information intended for higher-privileged accounts. The scope is marked as changed, meaning the disclosed data crosses the trust boundary of the vulnerable component and affects resources owned by other users or roles.
Root Cause
The root cause is a missing authorization check [CWE-862]. The GetStmUrlPath webapi component authenticates the caller but omits per-resource permission enforcement before returning the requested stream path information. Authentication alone is treated as sufficient to serve the response, which violates the principle of least privilege.
Attack Vector
Exploitation requires network access to the Surveillance Station webapi interface and valid low-privileged credentials. No user interaction is required. An attacker sends a crafted request to the GetStmUrlPath endpoint and receives sensitive stream path data belonging to other users or camera resources. The Synology advisory does not publish request-level exploitation details. See the Synology Security Advisory SA-24-04 for vendor-published technical details.
Detection Methods for CVE-2024-29228
Indicators of Compromise
- Unexpected HTTP requests to Surveillance Station webapi endpoints referencing GetStmUrlPath from low-privileged user sessions.
- Access to camera stream URL paths by accounts that are not assigned to those cameras in Surveillance Station role configuration.
- Repeated enumeration patterns against webapi/entry.cgi with SYNO.SurveillanceStation API parameters.
Detection Strategies
- Enable Surveillance Station and DSM access logging and forward events to a centralized log platform for query and correlation.
- Baseline normal GetStmUrlPath request volume per user account, and alert on deviations that indicate enumeration.
- Correlate webapi requests with the DSM user role assignments to identify authorization anomalies.
Monitoring Recommendations
- Monitor DSM audit logs for authenticated sessions accessing Surveillance Station APIs outside their assigned camera scope.
- Track failed and successful webapi calls to Surveillance Station endpoints and flag bursts from single accounts or IPs.
- Review network telemetry for external or untrusted internal IPs reaching the Surveillance Station web interface.
How to Mitigate CVE-2024-29228
Immediate Actions Required
- Upgrade Synology Surveillance Station to version 9.2.0-9289 or 9.2.0-11289 or later, per DSM version.
- Audit Surveillance Station user accounts and remove accounts that no longer require access.
- Restrict network exposure of the DSM and Surveillance Station web interface to trusted networks or VPN only.
Patch Information
Synology has released fixed versions of Surveillance Station. Upgrade to 9.2.0-9289 or 9.2.0-11289 or later, matching your DSM major version (6.2, 7.1, or 7.2). Refer to the Synology Security Advisory SA-24-04 for the version matrix and download instructions.
Workarounds
- Disable external access to Surveillance Station until the patched version is installed.
- Enforce strong, unique passwords and multi-factor authentication for all DSM accounts to reduce the pool of accounts that could be leveraged for exploitation.
- Limit Surveillance Station privileges to the minimum set of users required, and remove shared or generic accounts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
