Synology BeeStation Flaw Chain Leads to Root RCE Via Novel “Dirty File Write” SQL Injection, PoC Available

Synology BeeStation devices are shown in a vulnerability chain that can lead from unauthenticated access to root RCE, demonstrated by security researcher Kiddo with a PoC published after a Pwn2Own 2024 presentation. The exploit chain relies on three CVEs: CVE-2024-50629 (CRLF Injection), CVE-2024-50630 (Improper Authentication), and CVE-2024-50631 (SQL Injection), beginning with a pre-auth information disclosure that leaks internal data via an unsanitised redirect_url parameter.

According to Kiddo, the attacker uses CRLF injection to add an X-Accel-Redirect header, forcing the server to read internal files such as cloud-workerd.log to obtain a valid system username. With that username, the attacker bypasses login requirements by stripping the password in the syncd authentication flow, obtaining a valid access_token and moving to the SQL Injection step.

The final stage uses SQL Injection to write into /etc/cron.d/ by abusing the update_settings command, creating a cron job that yields a root reverse shell when cron parses the file. Synology has addressed these vulnerabilities in the latest DSM and BeeStation updates.