A sophisticated three-vulnerability chain affecting Synology BeeStation NAS devices enables unauthenticated attackers to achieve complete system compromise and root-level access through weaponization of the system’s task scheduler.
Security researchers have disclosed the technical details of this Pwn2Own 2024-winning exploit chain, demonstrating how seemingly low-severity primitives combine to create a critical attack surface.
The vulnerability chain exploits a CRLF injection flaw to leak valid usernames, bypasses authentication logic through improper parameter validation, and leverages SQL injection to inject malicious crontab entries.
The attack culminates in arbitrary code execution with root privileges through the cron daemon, bypassing traditional exploitation constraints found in PHP-free environments.
| CVE | Component | Version | Severity | Attack Vector |
|---|---|---|---|---|
| CVE-2024-50629 | DSM Operating System | < 7.2.2-72806-1 | High | CRLF Injection in HTTP redirect parameter enables file read via X-Accel-Redirect |
| CVE-2024-50630 | Synology Drive Server | < 3.5.1-26102 | High | Improper authentication in syncd daemon allows bypass via missing password validation |
| CVE-2024-50631 | Synology Drive Server | < 3.5.1-26102 | Critical | SQL Injection in update_settings command enables arbitrary code execution |
The first vulnerability (CVE-2024-50629) exploits a CRLF injection in the SYNO.API.Auth.RedirectURI endpoint.
By injecting HTTP headers via the redirect_url parameter, attackers leverage the X-Accel-Redirect nginx directive to access protected internal locations.
This grants unauthorized access to the Synology Drive initialization log, which contains system usernames a prerequisite for the authentication bypass.
The second vulnerability (CVE-2024-50630) stems from flawed authentication routing logic in the syncd daemon.
When the password parameter is omitted, the authentication handler falls through to domain socket authentication, which validates only the username without requiring a password.
Combined with the previously leaked username, this achieves authenticated access without valid credentials.
The third vulnerability (CVE-2024-50631) enables SQL injection within the update_settings command, affecting the sharing_link_customization and sharing_link_fully_custom_url parameters.
The unpatched code concatenates user input directly into SQL UPDATE statements without proper escaping.
Rather than traditional PHP web shell injection, researchers developed a universal SQLite injection RCE technique targeting crontab files.
The approach exploits the cron daemon’s fault tolerance: malformed lines are silently ignored, allowing valid crontab entries wrapped in newlines to coexist with SQLite binary metadata pollution.
The payload creates a new crontab file at /etc/cron.d/pwn.task containing a reverse shell command. When the cron daemon parses the file, it discards SQLite headers as invalid lines and executes only the valid crontab entry, establishing a root reverse shell.
Affected Synology BeeStation and other NAS models with Synology Drive Server are vulnerable to unauthenticated remote code execution.
Systems should be updated to DSM 7.2.2-72806-1 or later and Synology Drive Server 3.5.1-26102 or later.
This vulnerability chain represents a significant threat requiring immediate patching across all affected installations.
Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates
%20(1).webp?fit=1600,900&ssl=1&description=Security researchers have disclosed the technical details of this Pwn2Own 2024-winning exploit chain, demonstrating how seemingly low-severity primitives combine to create a critical attack surface.){kind=link}