CVE-2024-50631: Synology Drive Server SQLi Vulnerability

CVE-2024-50631 Overview

CVE-2024-50631 is a SQL injection vulnerability in the system syncing daemon of Synology Drive Server. The flaw allows remote attackers to inject SQL commands without authentication, with impact limited to write operations. The vulnerability is classified under CWE-89 for improper neutralization of special elements used in an SQL command. Affected versions include Synology Drive Server releases prior to 3.0.4-12699, 3.2.1-23280, 3.5.0-26085, and 3.5.1-26102. Synology published advisory Synology_SA_24_21 addressing the issue.

Critical Impact

Unauthenticated remote attackers can inject SQL write operations into the Synology Drive Server syncing daemon, enabling tampering of database records on affected DSM appliances.

Affected Products

• Synology Drive Server versions before 3.0.4-12699
• Synology Drive Server versions before 3.2.1-23280 and 3.5.0-26085
• Synology Drive Server versions before 3.5.1-26102

Discovery Timeline

• 2025-03-19 - CVE-2024-50631 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2024-50631

Vulnerability Analysis

The vulnerability resides in the system syncing daemon component of Synology Drive Server, the service responsible for coordinating file synchronization between clients and the DSM appliance. The daemon fails to properly neutralize special characters in SQL statements before passing them to the backend database. Attackers can send crafted requests over the network to inject arbitrary SQL fragments into queries executed by the daemon.

The issue is classified as CWE-89, SQL injection. According to the vendor advisory, exploitation does not require authentication or user interaction and impact is limited to write operations. Read-based data exfiltration through this vector is not described in the advisory. The EPSS score of 1.226% places the vulnerability in the 79th percentile for likelihood of exploitation activity.

Root Cause

The root cause is missing or insufficient input sanitization in SQL query construction within the syncing daemon. User-controllable input is concatenated into SQL statements rather than passed through parameterized queries or prepared statements. This permits attacker-supplied content to alter query semantics.

Attack Vector

The attack is delivered over the network against the Drive Server service. The Synology advisory does not document the specific request fields or endpoints used to reach the vulnerable code path. A remote attacker with network reachability to the Drive Server can submit crafted input that triggers SQL write operations such as INSERT, UPDATE, or DELETE against tables accessible to the daemon. See the Synology Security Advisory SA-24-21 for additional technical context.

Detection Methods for CVE-2024-50631

Indicators of Compromise

• Unexpected modifications, insertions, or deletions in Synology Drive Server database tables that do not correlate with legitimate user sync activity.
• Synology Drive Server daemon log entries containing SQL meta-characters such as single quotes, semicolons, or UNION, INSERT, and UPDATE keywords in request parameters.
• Network connections to Drive Server services from untrusted or unexpected source addresses.

Detection Strategies

• Inspect Drive Server and DSM logs for anomalous request payloads targeting the syncing daemon endpoints.
• Compare current Drive Server package versions against the fixed releases listed in the Synology advisory and flag any host running an unpatched version.
• Apply web application firewall or intrusion detection signatures that match common SQL injection patterns in traffic destined for Synology Drive Server ports.

Monitoring Recommendations

• Forward DSM and Drive Server logs to a centralized logging or SIEM platform for retention and correlation.
• Alert on authentication anomalies and on database write spikes originating from the syncing daemon process.
• Monitor outbound connections from the NAS appliance for signs of follow-on activity after a suspected injection.

How to Mitigate CVE-2024-50631

Immediate Actions Required

• Upgrade Synology Drive Server to 3.0.4-12699, 3.2.1-23280, 3.5.0-26085, 3.5.1-26102, or later, per the vendor advisory.
• Restrict network exposure of the Drive Server to trusted networks and authenticated VPN clients until patching is complete.
• Review database contents and Drive Server logs for evidence of unauthorized write activity prior to remediation.

Patch Information

Synology has released fixed packages for Drive Server. Refer to Synology Security Advisory SA-24-21 for the authoritative list of fixed versions and upgrade instructions. Apply the update through Package Center in DSM or by manually installing the corresponding package.

Workarounds

• Block external access to Drive Server ports at the perimeter firewall when immediate patching is not feasible.
• Place the NAS behind a reverse proxy or VPN that enforces authentication before traffic reaches the syncing daemon.
• Disable the Drive Server package on appliances that do not require synchronization services.

# Verify installed Synology Drive Server package version on DSM
synopkg version SynologyDriveServer

# Example: block external access to Drive Server (port 6690) at the DSM firewall
# Adjust source ranges to your trusted networks before applying
# (Run via DSM Control Panel > Security > Firewall, or via CLI as below)
iptables -A INPUT -p tcp --dport 6690 ! -s 10.0.0.0/8 -j DROP