Critical Out-Of-Bounds Write Flaw In Synology Vpn Plus Server Enables Arbitrary Code Execution

This article examines a critical vulnerability in Synology VPN Plus Server that enables the execution of arbitrary code remotely. The vulnerability, designated as CVE-2022-43931, possesses a severity rating of 10.0 and a CVSS3 Base Score of 10.0. This flaw affects VPN Plus Server for SRM 1.3 and 1.2. Users are advised to upgrade to versions 1.4.4-0635 or above for SRM 1.3, and 1.4.3-0534 or above for SRM 1.2. The vulnerability stems from an out-of-bounds write, which can result in data corruption, system crashes, and code execution after memory corruption occurs. In addition to this vulnerability, multiple security vulnerabilities in Synology Router Manager have also been addressed, possessing a critical severity rating. These vulnerabilities were reported by Gaurav Baruah and Computest, who disclosed them through Trend Micro’s Zero Day Initiative. Exploitation of these vulnerabilities was demonstrated at the Pwn2Own Toronto 2022 event, where participants were rewarded for successfully hacking Synology routers and NAS devices. To mitigate such vulnerabilities, the utilization of Secure Web Gateway features, such as web filter rules, activity tracking, and malware protection, is recommended.

Key Takeaways

• Synology VPN Plus Server has a critical out-of-bounds write vulnerability (CVE-2022-43931) that allows remote execution of arbitrary commands.
• The affected products are VPN Plus Server for SRM 1.3 and VPN Plus Server for SRM 1.2, and users are advised to upgrade to the specified versions.
• Outcomes of exploiting out-of-bounds write vulnerabilities include data corruption, system crashes, and code execution following memory corruption.
• Multiple security vulnerabilities in Synology Router Manager have been patched, and they were rated as critical.

Vulnerability Profile

The vulnerability profile of the critical out-of-bounds write flaw in Synology VPN Plus Server is characterized by a CVE ID of CVE-2022-43931, a severity level of Critical, and a CVSS3 Base Score of 10.0. This flaw allows for remote execution of arbitrary commands. The impact on network security is significant, as it enables attackers to gain unauthorized access to the system and execute malicious code. By exploiting this vulnerability, attackers can potentially cause data corruption, system crashes, and execute arbitrary commands following memory corruption. Therefore, it is crucial for users to apply timely software updates provided by Synology to mitigate this vulnerability. Keeping the software up to date is essential to ensure the security and integrity of the network and prevent potential attacks.

Affected Products

Affected Products include VPN Plus Server for SRM 1.3 (Upgrade to 1.4.4-0635 or above) and VPN Plus Server for SRM 1.2 (Upgrade to 1.4.3-0534 or above).

• Patching and vulnerability management for Synology VPN Plus Server: It is crucial for organizations to regularly update their VPN Plus Server to the latest version provided by Synology. This ensures that any known vulnerabilities, such as the critical out-of-bounds write flaw (CVE-2022-43931), are patched and the system is protected against potential attacks.

• Best practices for securing VPN servers in enterprise environments: In addition to patching, organizations should implement best practices to secure their VPN servers. This includes using strong encryption algorithms, enforcing strong authentication mechanisms, implementing strict access controls, regularly monitoring and auditing server activity, and conducting thorough vulnerability assessments. By following these practices, enterprises can significantly reduce the risk of unauthorized access and potential exploitation of vulnerabilities in their VPN servers.

Exploitation and Earnings

Exploitation of the vulnerability resulted in significant earnings for participants at the Pwn2Own contest, with hackers earning over $80,000 for successfully compromising Synology routers and NAS devices. The exploit involved the demonstration of various exploitation techniques, such as attacking the WAN interface and achieving a root-shell attack on the LAN interface. These successful exploits showcased the severity of the out-of-bounds write flaw in the Synology VPN Plus Server. The hackers were rewarded $20,000 for their exploit on the WAN interface and an additional $5,000 for the root-shell attack on the LAN interface. The prize money distribution at the Pwn2Own contest highlighted the value and impact of discovering and exploiting vulnerabilities in critical network infrastructure.

Frequently Asked Questions

How can the Synology VPN Plus Server vulnerability be exploited?

The Synology VPN Plus Server vulnerability can be exploited through various exploitation techniques, such as crafting malicious input to trigger the out-of-bounds write flaw. Mitigation strategies include applying the latest patches and updates provided by Synology to address the vulnerability.

What are the potential consequences of the out-of-bounds write vulnerability?

The potential consequences of the out-of-bounds write vulnerability in Synology VPN Plus Server include data leakage and remote code execution. This flaw could lead to unauthorized access, compromise of sensitive information, and the execution of arbitrary commands by attackers.

Were any other security vulnerabilities patched in Synology Router Manager?

Yes, multiple security vulnerabilities were patched in Synology Router Manager. These vulnerabilities were rated as Critical severity and were addressed to enhance the security of the platform. The analysis of the Synology Router Manager vulnerabilities aimed to ensure a robust and secure system.

Who reported the vulnerabilities and how were they disclosed?

The vulnerabilities in Synology VPN Plus Server were reported by Gaurav Baruah and Computest. They disclosed the vulnerabilities through Trend Micro’s Zero Day Initiative, a program that facilitates responsible vulnerability disclosure.

What are some of the features provided by the Secure Web Gateway?

The secure web gateway offers various features that provide benefits to users. These include web filter rules, activity tracking, and malware protection. These features help ensure secure and controlled internet access, monitor user activities, and protect against malicious threats.