------------------------------------------------------------------------
Synology Photo Station multiple Cross-Site Scripting vulnerabilities
------------------------------------------------------------------------
Han Sahin, May 2015

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
Multiple reflected Cross-Site scripting vulnerabilities were found in
Synology Photo Station. These issues allow attackers to perform a wide
variety of actions, such as stealing victims' session tokens or login
credentials if available, performing arbitrary actions on their behalf
but also performing arbitrary redirects to potential malicious websites.

------------------------------------------------------------------------
Tested version
------------------------------------------------------------------------
This issue was tested on Synology Photo Station version 6.2-2858.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
Synology reports that this issue has been resolved in Photo Station
version 6.3-2945.
https://www.synology.com/en-us/releaseNote/PhotoStation

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://www.securify.nl/advisory/SFY20150504/synology_photo_station_multiple_cross_site_scripting_vulnerabilities.html

Success parameter of login.php

As shown in the code fragment below of the mobile login.php page, the success request parameter is not HTML encoded (htmlentities) in the point where it is copied into application's response, rendering the Photo Station mobile login page vulnerable to reflected Cross-Site Scripting.

if (isSet($_GET['success'])) {
   $smarty->assign('alertMsg', $_GET['success']);
}

The following proof of concept demonstrates this issue:
http://<target>/photo/m/login.php?success=Reflected:%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
URL parameters of index.php

The code fragment below shows that URL parameters are not HTML encoded when they are used into application's response, rendering the Photo Station pages vulnerable to reflected Cross-Site Scripting.

function FormData($data, $url)
{
      $urlPrefix = csSYNOPhotoMisc::GetServerHost().SYNOPHOTO_URL_PREFIX;
   
   return array(
      'type' => htmlspecialchars($data['type']),
      'title' => htmlspecialchars($data['title']),
      'description' => htmlspecialchars($data['desc']),
      'img' => $urlPrefix . $data['img'] ,
      'url' => $urlPrefix . $url
   );
}

Tricking a victim into visiting a specially crafted URL allows attackers to run arbitrary client-side scripting code within the victim's browser. The attacker-supplied code can perform a wide variety of actions, such as stealing victims' session tokens or login credentials if available, performing arbitrary actions on their behalf but also performing arbitrary redirects to potential malicious websites.

The following proof of concept demonstrates this issue:
http://<target>/photo/?t="><IFRAME>