CVE-2024-47264

Vulnerability

A path traversal vulnerability (CVE-2024-47264) exists in the agent-related functionality of Synology Active Backup for Business prior to versions 2.7.1-13234 (DSM 7.1), 2.7.1-23234 (DSM 7.2), and 2.7.1-3234 (DSM 6.2). The software improperly limits a file path to a restricted directory, enabling arbitrary file deletion via unspecified vectors [1].

Exploitation

To exploit this vulnerability, an attacker must be a remote, authenticated user with administrator privileges. No user interaction is required, and the attack is carried out over the network with low complexity. The specific steps involve using the agent-related feature to supply a crafted path that escapes the intended directory [1].

Impact

Successful exploitation allows the attacker to delete arbitrary files on the system, compromising the integrity of the affected Synology device. This can lead to denial of service or system disruption, but does not directly allow data read or execution of arbitrary code [1].

Mitigation

Synology has released fixed versions: upgrade to Active Backup for Business 2.7.1-13234 for DSM 7.1, 2.7.1-23234 for DSM 7.2, or 2.7.1-3234 for DSM 6.2. No workarounds are provided in the advisory [1].