CVE-2020-27660
📋 TL;DR
This SQL injection vulnerability in Synology SafeAccess allows remote attackers to execute arbitrary SQL commands via the domain parameter in request.cgi. Attackers can potentially read, modify, or delete database contents, and in worst cases achieve remote code execution. All Synology SafeAccess installations before version 1.2.3-0234 are affected.
💻 Affected Systems
- Synology SafeAccess
📦 What is this software?
Safeaccess by Synology
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, and lateral movement within the network.
Likely Case
Database manipulation, credential theft, privilege escalation, and potential access to sensitive network information.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only information disclosure.
🎯 Exploit Status
Public proof-of-concept available, exploitation requires network access to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.3-0234 or later
Vendor Advisory: https://www.synology.com/security/advisory/Synology_SA_20_25
Restart Required: Yes
Instructions:
1. Log into DSM as administrator. 2. Open Package Center. 3. Find SafeAccess. 4. Click Update if available. 5. Alternatively, download latest version from Synology website and manually install.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to SafeAccess web interface using firewall rules.
Disable SafeAccess
allTemporarily disable SafeAccess package until patching is possible.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable systems
- Deploy web application firewall with SQL injection protection rules
🔍 How to Verify
Check if Vulnerable:
Check SafeAccess package version in DSM Package Center. If version is earlier than 1.2.3-0234, system is vulnerable.Check Version:
No direct command. Check via DSM web interface: Package Center > Installed > SafeAccessVerify Fix Applied:
Verify SafeAccess version shows 1.2.3-0234 or later in Package Center.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed login attempts followed by successful access
- Unexpected database operations
Network Indicators:
- HTTP requests to request.cgi with SQL-like patterns in parameters
- Unusual outbound database connections from SafeAccess server
SIEM Query:
source="synology" AND (url="*request.cgi*" AND (param="*domain=*SELECT*" OR param="*domain=*UNION*" OR param="*domain=*OR*"))🔗 References
- https://github.com/thomasfady/Synology_SA_20_25
- https://www.synology.com/security/advisory/Synology_SA_20_25
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1087
- https://github.com/thomasfady/Synology_SA_20_25
- https://www.synology.com/security/advisory/Synology_SA_20_25
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1087
