External risk intelligence

Synology DSM CSRF Allows Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2024-45538

The vulnerability affects Synology DiskStation Manager (DSM), which is an operating system for network-attached storage devices frequently exposed to the internet to facilitate remote access, file sharing, and management services.

Cross-site Request Forgery

Synology Diskstation Manager

7.2.1-69057 to before 7.2.1-69057-27.2.2-72803 to before 7.2.2-728063.1-23028 to before 3.1.4-23079

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical Cross-Site Request Forgery vulnerability has been identified in Synology DiskStation Manager and Unified Controller software, potentially allowing remote attackers to execute arbitrary code without user interaction. The main concern at this time is confirming relevance and exposure within your environment.

Attackers can trick users into performing actions.
Exploitation could lead to unauthorized code execution.
Confirm if your Synology devices are affected.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by tricking a user into interacting with a malicious link or element. This interaction would then trigger an unintended action on the user's behalf within the Synology DiskStation Manager (DSM) or Synology Unified Controller (DSMUC), potentially leading to arbitrary code execution.

No authentication required.
Triggered via user interaction.
Allows arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A Cross-Site Request Forgery (CSRF) vulnerability in Synology's DiskStation Manager and Unified Controller could allow remote attackers to execute arbitrary code. This could occur if a user visits a malicious website while logged into a vulnerable DSM or DSMUC system.

System data and service behavior at risk.
Malicious website visit triggers code execution.
Potential for unauthorized system access or control.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical CSRF vulnerability in Synology DSM and DSMUC requires immediate attention from teams managing these devices. The first practical step is to inventory all Synology devices, determine their internet exposure, and confirm their business criticality to prioritize remediation. This involves identifying the accountable team, whether it's infrastructure, security, or a dedicated NAS administration group, and coordinating the update or mitigation process.

Infrastructure or NAS owners should lead remediation.
Verify internet-facing DSM/DSMUC instances.
Plan controlled updates or implement mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Synology DiskStation Manager?

Synology DiskStation Manager (DSM) is the web-based operating system that powers Synology network-attached storage (NAS) devices. It provides the central management interface for users to store, share, and protect data, as well as run various server applications and services directly on their hardware.

What does CWE-352 mean for CVE-2024-45538?

CWE-352 refers to Cross-Site Request Forgery (CSRF). In the context of CVE-2024-45538, this weakness allows an attacker to manipulate the web interface into performing unauthorized actions. Instead of the system verifying that a request was intentionally made by the administrator, it processes the request as if the logged-in user had authorized it, which can escalate to arbitrary code execution.

How is this vulnerability triggered?

The vulnerability is triggered when a user with an active, authenticated session in the web interface visits a malicious website or interacts with a crafted link. It does not trigger if there is no active session, nor does it automatically execute without that specific user-side interaction. Essentially, the attacker relies on the browser's ability to send requests to the DSM interface on the user's behalf.

Is my Synology device at risk according to Halo Surface Signal?

Halo Surface Signal indicates that the risk level is likely elevated for devices exposed to the internet. Because DSM is often configured for remote file access and management, it frequently sits in a position where external actors can reach the login interface. Devices that are restricted to internal, private networks face a lower probability of being targeted through this specific web-based attack vector.

How should I respond to this threat?

The immediate priority is to locate all instances of DSM and DSMUC within your infrastructure to assess which are reachable from the internet. Once identified, ensure your systems are updated to the patched versions provided by Synology. If immediate updates are not feasible, consider restricting network access to these administrative interfaces until you can apply the necessary software versions.

References

www.synology.com/en-global/security/advisory/Synology_SA_24_27

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.