CVE-2017-11156 File upload in Synology Download Station
Remote authenticated users can execute arbitrary code by uploading an executable due to weak directory permissions in Synology Download Station.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-11156?
CVE-2017-11156 is a high-severity vulnerability in Synology Download Station, published on 14 Aug 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Synology Download Station 3.8.x before 3.8.5-3475 and 3.x before 3.5-2984 uses weak permissions (0777) for ui/dlm/btsearch directory, which allows remote authenticated users to execute arbitrary code by uploading an executable via unspecified vectors.
Which versions are affected by CVE-2017-11156?
It affects 1 product.
Products include Synology Download Station.
How do I fix CVE-2017-11156?
No fix has been published for CVE-2017-11156 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-11156 being exploited?
There is no known exploitation of CVE-2017-11156 in the wild and no public exploit code.
Other vulnerabilities in Synology Download Station
- CVE-2021-34809 Command injection in Download Station
- CVE-2021-34810 Privilege escalation in Download Station
- CVE-2021-33184 Server-side request forgery in Synology Download Station
- CVE-2017-11149 Server-side request forgery in Synology Download Station
- CVE-2021-34811 Server-side request forgery in Download Station
Sources
Also known as GHSA-qqc7-r2fw-p594.