CVE-2016-10329 - OpenCVE

Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Synology	Photo Station

Configuration 1 [-]

cpe:2.3:a:synology:photo_station:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://seclists.org/oss-sec/2016/q1/236
https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-01-PhotoStation-Login-without-password
https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-02-PhotoStation-Remote-Code-Execution
https://www.synology.com/en-global/support/security/Photo_Station_6_5_3_3226

History

No history.

MITRE

Status: PUBLISHED

Assigner: synology

Published: 2017-05-12T20:00:00

Updated: 2024-08-06T03:14:42.953Z

Reserved: 2017-04-18T00:00:00

Link: CVE-2016-10329

Vulnrichment

No data.

NVD

Status : Modified

Published: 2017-05-12T20:29:00.203

Modified: 2019-10-09T23:16:36.747

Link: CVE-2016-10329

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Synology Photo Station", "vendor": "Synology", "versions": [{"status": "affected", "version": "All versions prior to version 6.5.3-3226"}]}], "datePublic": "2016-08-02T00:00:00", "descriptions": [{"lang": "en", "value": "Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-77", "description": "Arbitrary Code Execution (CWE-77)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2017-05-12T19:57:01", "orgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "shortName": "synology"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.synology.com/en-global/support/security/Photo_Station_6_5_3_3226"}, {"tags": ["x_refsource_MISC"], "url": "https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-01-PhotoStation-Login-without-password"}, {"tags": ["x_refsource_MISC"], "url": "https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-02-PhotoStation-Remote-Code-Execution"}, {"name": "[oss-security] 20160128 CVE request: Synology Photo Station command injection and privilege escalation", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://seclists.org/oss-sec/2016/q1/236"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@synology.com", "ID": "CVE-2016-10329", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Synology Photo Station", "version": {"version_data": [{"version_value": "All versions prior to version 6.5.3-3226"}]}}]}, "vendor_name": "Synology"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Arbitrary Code Execution (CWE-77)"}]}]}, "references": {"reference_data": [{"name": "https://www.synology.com/en-global/support/security/Photo_Station_6_5_3_3226", "refsource": "CONFIRM", "url": "https://www.synology.com/en-global/support/security/Photo_Station_6_5_3_3226"}, {"name": "https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-01-PhotoStation-Login-without-password", "refsource": "MISC", "url": "https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-01-PhotoStation-Login-without-password"}, {"name": "https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-02-PhotoStation-Remote-Code-Execution", "refsource": "MISC", "url": "https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-02-PhotoStation-Remote-Code-Execution"}, {"name": "[oss-security] 20160128 CVE request: Synology Photo Station command injection and privilege escalation", "refsource": "MLIST", "url": "http://seclists.org/oss-sec/2016/q1/236"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T03:14:42.953Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.synology.com/en-global/support/security/Photo_Station_6_5_3_3226"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-01-PhotoStation-Login-without-password"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-02-PhotoStation-Remote-Code-Execution"}, {"name": "[oss-security] 20160128 CVE request: Synology Photo Station command injection and privilege escalation", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://seclists.org/oss-sec/2016/q1/236"}]}]}, "cveMetadata": {"assignerOrgId": "db201096-a0cc-46c7-9a55-61d9e221bf01", "assignerShortName": "synology", "cveId": "CVE-2016-10329", "datePublished": "2017-05-12T20:00:00", "dateReserved": "2017-04-18T00:00:00", "dateUpdated": "2024-08-06T03:14:42.953Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:synology:photo_station:*:*:*:*:*:*:*:*", "matchCriteriaId": "5760E52D-1708-4C41-B8F3-0348D1F38944", "versionEndIncluding": "6.5.2-3225", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n de comandos en login.php en Synology Photo Station en versiones anteriores a la 6.5.3-3226, que permitir\u00eda a atacantes remotos ejecutar c\u00f3digo arbitrario a trav\u00e9s metacaracteres de shell en una cabecera 'X-Forwarded-For' manipulada."}], "id": "CVE-2016-10329", "lastModified": "2019-10-09T23:16:36.747", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-05-12T20:29:00.203", "references": [{"source": "security@synology.com", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "url": "http://seclists.org/oss-sec/2016/q1/236"}, {"source": "security@synology.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-01-PhotoStation-Login-without-password"}, {"source": "security@synology.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://bamboofox.github.io/2017/03/20/Synology-Bug-Bounty-2016/#Vul-02-PhotoStation-Remote-Code-Execution"}, {"source": "security@synology.com", "tags": ["Release Notes"], "url": "https://www.synology.com/en-global/support/security/Photo_Station_6_5_3_3226"}], "sourceIdentifier": "security@synology.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-77"}], "source": "security@synology.com", "type": "Secondary"}]}