CVE-2024-45538

The attacker exploits the CSRF mechanism by forcing a logged-in user to unknowingly execute a crafted request to the WebAPI Framework interface of the Synology device. The request is executed in the context of the victim's session, allowing bypass of standard authorization. As a result, the application processes the malicious request as legitimate, leading to arbitrary code execution on the device (RCE). The attack does not require privileges on the attacker's side, but requires interaction from an authenticated user (e.g., clicking a crafted link).

An attacker can execute arbitrary code on the vulnerable device, leading to complete system takeover, including violation of data confidentiality and integrity, and loss of NAS service availability.

Synology DiskStation Manager should be updated to version 7.2.1-69057-2 or later in the 7.2.1 branch, to version 7.2.2-72806 or later in the 7.2.2 branch, and Synology Unified Controller (DSMUC) to version 3.1.4-23079 or later. Details available in the official Synology SA-24-27 security bulletin.

Synology DiskStation Manager (DSM) in versions prior to 7.2.1-69057-2 and 7.2.2-72806; Synology Unified Controller (DSMUC) in versions prior to 3.1.4-23079.