CVE-2024-47273 Overview
CVE-2024-47273 is a path traversal vulnerability [CWE-22] affecting the Backup Task functionality in Synology Hyper Backup. The flaw exists in versions before 4.1.2-4036 and allows remote authenticated users to write specific files via unspecified vectors. Synology Hyper Backup is a backup management application that runs on DiskStation Manager (DSM) and protects data across local, network, and cloud destinations.
The vulnerability stems from improper limitation of a pathname to a restricted directory. An authenticated attacker can manipulate file paths during backup task operations to write files outside the intended directory scope.
Critical Impact
An authenticated remote attacker can write files to unintended locations on a Synology NAS running a vulnerable Hyper Backup release, affecting file integrity.
Affected Products
- Synology Hyper Backup versions prior to 4.1.2-4036
- Synology DiskStation Manager (DSM) deployments running affected Hyper Backup builds
- Synology NAS appliances with Hyper Backup enabled (for example, DS224+ class systems referenced in the vendor release notes)
Discovery Timeline
- 2026-06-03 - CVE-2024-47273 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2024-47273
Vulnerability Analysis
The vulnerability resides in the Backup Task component of Synology Hyper Backup. The component fails to properly sanitize pathname inputs supplied during backup task configuration or execution. An authenticated user with access to Hyper Backup can craft input that escapes the intended directory boundary using traversal sequences.
The attack vector is network-based and requires existing authenticated access to the Synology appliance. User interaction is not required. Exploitation affects integrity but not confidentiality or availability based on the published CVSS vector.
Root Cause
The root cause is missing or insufficient validation of pathname inputs before file write operations [CWE-22]. The Backup Task functionality accepts path-related parameters and uses them in file system operations without canonicalizing the resulting path or constraining it to an allowed directory. Path traversal sequences such as ../ are not filtered or normalized before the write occurs.
Attack Vector
An authenticated attacker connects to the Synology DSM web interface over the network. The attacker interacts with the Hyper Backup Backup Task functionality and submits parameters containing path traversal sequences. The application processes the input and writes attacker-influenced content to a location outside the expected backup directory. The vendor advisory does not disclose the specific parameters or endpoints involved. See the Synology Release Notes for HyperBackup for vendor-published details.
Detection Methods for CVE-2024-47273
Indicators of Compromise
- Unexpected files written outside standard Hyper Backup directories on the DSM volume
- Modifications to system or configuration files coinciding with Hyper Backup task execution
- Backup task definitions containing unusual path components such as ../ sequences or absolute paths to non-backup locations
Detection Strategies
- Audit Hyper Backup task configurations for path parameters that reference directories outside intended backup repositories
- Review DSM and Hyper Backup logs for backup task creation or modification events from non-administrative accounts
- Compare installed Hyper Backup package version against the patched build 4.1.2-4036 across all managed Synology appliances
Monitoring Recommendations
- Forward DSM system logs and Hyper Backup logs to a centralized logging platform for correlation and retention
- Alert on file system writes to sensitive directories that originate from Hyper Backup processes
- Monitor authentication events on DSM for low-privilege accounts that subsequently access Hyper Backup
How to Mitigate CVE-2024-47273
Immediate Actions Required
- Upgrade Synology Hyper Backup to version 4.1.2-4036 or later through Package Center on each affected DSM appliance
- Restrict Hyper Backup access to administrative accounts only and remove unnecessary user permissions on the DSM web interface
- Audit existing backup task definitions for unexpected or attacker-controlled path values and remove suspicious entries
Patch Information
Synology has released Hyper Backup 4.1.2-4036, which remediates the path traversal flaw in the Backup Task functionality. Administrators should apply the update via Package Center in DSM or download it from the vendor. Refer to the Synology Release Notes for HyperBackup for version-specific guidance and release details.
Workarounds
- Limit network exposure of the DSM management interface by restricting it to trusted management networks or VPN access
- Disable Hyper Backup temporarily on appliances that cannot be patched immediately, until the fixed version is installed
- Enforce strong authentication, including two-factor authentication, for all DSM accounts with access to Hyper Backup
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
