CVE-2017-11154

published 2017-08-08

CVE-2017-11154: Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create…

Priority P2 61 high 7.2 CVSS 3.0

AV N AC L PR H UI N S U C H I H A H

EXPLOIT

Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
synology	photo_station	<= 6.7.2-3429	—
synology	photo_station	—	—
synology	synology_photo_station	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /photo/include/synotheme_upload.php↗

url /photo/include/file_upload.php↗

url /photo/admin/general_setting.php↗

url /photo/PixlrEditorHandler.php↗

url /photo/facebook/exploit.php↗

path /../../../../../var/packages/PhotoStation/etc/blog/photo_custom_preview_logo.png↗

path /../../../../../var/services/photo/@eaDir/SYNOPHOTO_THEME_DIR/photo_custom_preview_logo.png↗

path /volume1/@appstore/PhotoStation/photo/facebook/exploit↗

filename PixlrEditorHandler.php↗

other type=php↗

cookie session=/../../../../../var/packages/PhotoStation/etc/blog/photo_custom_preview_logo.png↗

• → Detect exploitation chain step 1: POST to /photo/include/synotheme_upload.php with action=logo_upload and a file containing a serialized PHP session string (e.g. 'root|a:2:{s:19:"security_identifier"...}') used to plant a fake admin session. ↗
• → Detect exploitation chain step 2: POST to /photo/include/file_upload.php with a 'session' parameter containing a path traversal sequence (e.g. /../../../../../) to hijack a privileged session from a planted file. ↗
• → Detect exploitation chain step 3: POST to /photo/PixlrEditorHandler.php with parameters action=save, type=php, and a base64-encoded 'path' pointing to a web-accessible directory — this is the direct file upload vulnerability (CVE-2017-11154). ↗
• → Detect webshell execution: GET request to /photo/facebook/exploit.php following a successful upload — monitor for unexpected PHP file creation and access under the /photo/facebook/ path. ↗
• → Monitor for processes spawned as uid=138862 (PhotoStation) on Synology NAS, which indicates successful RCE via this exploit chain. ↗
• → Flag use of data:// stream wrapper in POST body to PixlrEditorHandler.php (e.g. 'data://text/plain;base64,...'), which is used to supply arbitrary PHP code as the image content. ↗

• · The path traversal payload used in step 2 (session parameter) varies by Synology Photo Station version; two alternate paths are documented in the exploit. ↗
• · The RCE is a chained exploit combining four distinct vulnerabilities: arbitrary file upload, fake authentication mechanism, identity spoofing, and authenticated code execution — all four steps must be detected/blocked to fully mitigate. ↗

CVSS provenance

nvd v3.0 7.2 HIGH CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.5 MEDIUM AV:N/AC:L/Au:S/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434