DisguiseDelimit: Exploiting Synology NAS with Delimiters and Novel Tricks

DisguiseDelimit: Exploiting Synology NAS with Delimiters and Novel Tricks

Speakers: Ryan Emmons

Conference: DEF CON 33

YouTube: https://www.youtube.com/watch?v=3F5icGjDWfg

Slides: https://media.defcon.org/DEF%20CON%2033/DEF%20CON%2033%20presentations/Ryan%20Emmons%20-%20DisguiseDelimit%20Exploiting%20Synology%20NAS%20with%20Delimiters%20and%20Novel%20Tricks.pdf

Overview

Ryan Emmons, a staff security researcher at Rapid7, delivered this talk to chronicle his zero-day research into Synology network-attached storage (NAS) devices and the $40,000 prize it earned him at the Pwn2Own Ireland competition. Rather than a straightforward vulnerability disclosure, the talk presents a rich case study in the creative process of applied offensive security research — from black-box reconnaissance on a consumer appliance through to a working, weaponized exploit chain.

The research centers on an unauthenticated vulnerability in Synology's DiskStation Manager (DSM) operating system, achieved by abusing delimiter-handling quirks that affect how the platform interprets filenames, paths, and service boundaries. Emmons also introduces a novel Linux exploitation technique he discovered during the development process — a broadly applicable primitive that extends well beyond Synology targets and may affect a wide range of Linux-based embedded devices.

The talk is structured as a master class for aspiring zero-day researchers: what attack surface looks like on a constrained appliance, how to triage and prioritize bugs efficiently, and how to chain individually weak primitives into a reliable, unauthenticated RCE.

Background

▶ Watch: Discovery: delimiter confusion vulnerability class in DSM (0:54)

Synology NAS devices are ubiquitous in home offices, small businesses, and enterprise branch environments. They run a hardened Linux-based OS called DiskStation Manager (DSM), which provides a web interface, a rich set of first- and third-party packages, and multiple network-facing services including Samba, rsync, WebDAV, and a proprietary DDNS/QuickConnect infrastructure. Their network reachability and value as data-storage assets make them highly attractive targets.

The Pwn2Own competition, run by the Zero Day Initiative (ZDI), requires researchers to demonstrate working, previously unknown exploits against defined target devices within a narrow time window. Competing in the NAS category, Emmons received a Synology BeeStation — a consumer-grade NAS — as his research target roughly a year before the contest. His goal was to achieve pre-authentication remote code execution.

Synology's DSM has been the subject of prior vulnerability research, and the company operates a reasonable responsible disclosure process. However, the web stack — based on PHP and CGI components served through nginx — still offered significant unexplored attack surface, particularly in how different layers of the stack handle special characters and path delimiters.

Key Findings

▶ Watch: Background: Pwn2Own Ireland and the $40,000 NAS research prize (2:42)

Unauthenticated Attack Surface Mapping

Emmons began by mapping all HTTP/HTTPS endpoints accessible without authentication. DSM's web interface is extensive; even unauthenticated, it exposes dozens of CGI endpoints and a rich API surface used by the mobile app, QuickConnect relay service, and the browser-based management interface. Using a combination of static analysis of the DSM firmware (available as downloadable update packages) and dynamic observation, he catalogued the API namespace and its parameter schema.

The attack surface triage identified several areas where user-controlled input — particularly filename-like strings and path components — was passed through multiple software layers with inconsistent sanitization.

Delimiter Confusion as a Vulnerability Class

The core discovery was a class of vulnerabilities rooted in how Synology's DSM processes delimiters such as /, \, ., and null bytes in user-supplied parameters. Different subsystems within DSM interpret the same input differently: the PHP front-end might sanitize a path relative to one root, while the underlying C library or CGI binary interprets the same string against a different root or with different escape rules.

By carefully crafting input strings with embedded delimiters — effectively "disguising" one type of path component as another — Emmons was able to escape expected directory contexts and access file paths that should have been inaccessible to unauthenticated users. This delimiter confusion affected a specific DSM CGI endpoint that handled file-related operations during device setup or registration flows.

Achieving Pre-Authentication Code Execution

The delimiter confusion primitive was chained with a secondary issue in how DSM processed the resulting file access. By writing attacker-controlled content to a location reachable by the web server process, and then triggering execution of that content through a separate request, Emmons was able to achieve unauthenticated remote code execution. The full chain operated without any valid user credentials against a default-configured BeeStation.

Novel Linux Exploitation Technique

Perhaps the most broadly interesting contribution of the talk is a novel Linux exploitation primitive that Emmons stumbled upon while developing his exploit. The technique relates to how the Linux dynamic linker (ld.so) and certain SUID/SGID-aware execution flows handle environment or configuration state in edge cases that are not well-covered by existing exploit mitigations.

The specific technique was discovered when Emmons was trying to elevate privileges after achieving an initial low-privilege foothold on the NAS. Without disclosing every detail before broader patching, the core idea involves using a combination of environment manipulation and specific conditions in how ELF binaries are loaded or how shared libraries are resolved in constrained filesystem contexts common on embedded Linux devices.

Emmons emphasizes that this technique is likely applicable to many embedded Linux targets beyond Synology, wherever similar filesystem layouts and privilege-escalation opportunities exist.

Technical Deep Dive

▶ Watch: Novel Linux exploitation technique: ld.so / GIC profiling primitive (26:59)

DSM Firmware Analysis

Synology DSM firmware images are distributed as .pat files that can be extracted with standard tooling. The web-facing PHP and CGI layer is largely accessible for static analysis. Key components include:

• nginx as the HTTP front end, forwarding to PHP-FPM and to native CGI binaries
• A PHP API framework (webapi.cgi, entry.cgi) that dispatches requests to individual PHP modules
• Native CGI binaries for performance-sensitive operations (network configuration, storage management, package management)

Parameter validation occurs at multiple levels — in the PHP dispatch layer, within individual PHP modules, and within native code — with inconsistencies between layers creating the vulnerability surface Emmons exploited.

The Delimiter Vulnerability

The vulnerable endpoint accepted a parameter that was expected to be a relative path or filename. The PHP dispatch layer performed validation against a whitelist of allowed characters. However, a specific combination of delimiters — where a trailing or embedded character caused the PHP layer to interpret the path relative to a safe root while the underlying native binary resolved the same string against the filesystem root — allowed directory traversal outside the intended scope.

Emmons documented the exact sequence of delimiter characters (a combination involving path separators and encoding artifacts) that produced this split interpretation. The "DisguiseDelimit" name captures the essential technique: the delimiter combination disguises a traversal path as a safe relative filename to one layer while revealing the traversal to another.

File Write to RCE

With directory traversal into the webroot achieved, writing attacker-controlled content (e.g., a PHP shell or a CGI payload) to an accessible location converted the traversal into a code execution primitive. The write was triggered through a legitimate-looking API call, with the malicious filename parameter carrying the disguised delimiter sequence.

A subsequent HTTP request to the written file then executed the payload as the web server's effective user, achieving the first stage of code execution. This is a classic pattern for web-based RCE chains, but the novel element here was the delimiter confusion that enabled the write without authentication.

Privilege Escalation

From the initial web-server-level shell, Emmons applied his novel Linux exploitation technique to escalate privileges. The technique exploits subtle behavior in how ld.so or related runtime components handle certain edge cases involving SUID binaries on the embedded Linux filesystem. The interaction between the constrained filesystem layout typical of NAS appliances and standard Linux privilege primitives created an exploitable condition that would not be readily apparent from reviewing standard hardening guides.

The final result was a root shell on the BeeStation device, achieved from a pre-authentication starting point over the network.

Demo / Proof of Concept

▶ Watch: Technical deep dive: linker path manipulation with PID suffix (31:27)

Emmons presented a live demonstration video (pre-recorded to avoid network issues) showing the complete exploit chain executing against an unmodified, default-configured Synology BeeStation. The demo showed:

1. An HTTP request to the vulnerable endpoint with the disguised delimiter sequence in the filename parameter
2. Confirmation that a PHP webshell had been written outside the intended directory
3. A follow-up HTTP request executing the webshell and returning an interactive shell as the web server user
4. Application of the privilege escalation technique to elevate to root
5. A root prompt on the target device

The entire chain from initial HTTP request to root shell executed in under 30 seconds, illustrating the reliability of the exploit once properly developed.

Defensive Implications

▶ Watch: Live demo: copy-paste payload achieves unauthenticated RCE on BeeStation (42:45)

For Synology users:

• Apply the patches that Synology released in response to Emmons' responsible disclosure. Emmons coordinated with Synology and ZDI prior to the Pwn2Own demonstration; patches were released within the standard disclosure timeline.
• Limit NAS exposure to the internet. QuickConnect and direct port-forwarding of DSM's management ports (5000/5001) should be restricted where possible. Consider VPN-only access for management.
• Monitor NAS devices for unexpected process spawning, new files in the webroot, and outbound connections, as these are indicators of a post-exploitation foothold.

For embedded Linux device vendors broadly:

• The delimiter confusion vulnerability class is a direct consequence of passing user input through multiple software layers with independently implemented validation. Defense-in-depth input validation should be applied at the boundary between privilege levels, not just at the outermost layer.
• The novel Linux exploitation technique described affects devices that retain SUID binaries and do not apply the full set of Linux privilege mitigations (namespace isolation, capability dropping, seccomp). Hardening the execution environment — removing unnecessary SUID bits, applying filesystem mount options like nosuid, and using seccomp profiles — reduces the exploitability of similar primitives.

For defenders and detection engineers:

• Watch for unexpected HTTP requests to DSM CGI endpoints with parameters containing path delimiters, null bytes, or percent-encoded sequences.
• File integrity monitoring on the DSM webroot and other web-accessible directories provides early warning of a successful file-write primitive.

Key Takeaways

• Delimiter confusion across software layer boundaries is a productive and underexplored vulnerability class on embedded Linux appliances, including consumer NAS devices.
• The Synology BeeStation (and by extension, DSM-based devices) was compromised with a pre-authentication RCE chain discovered by methodically mapping and testing the unauthenticated attack surface.
• Emmons won $40,000 at Pwn2Own Ireland for this research, validating the practical impact.
• A novel Linux exploitation technique discovered during the research extends the work's reach beyond Synology to other embedded Linux targets with similar filesystem and SUID configurations.
• Vendors serving network-attached appliances should audit parameter handling across every layer of their web stack, not just the outermost validation point.

About the Speaker

Ryan Emmons is a Staff Security Researcher at Rapid7 with approximately four years of zero-day research experience. His work focuses on zero-day discovery and in-day vulnerability analysis. He has reported vulnerabilities to organizations including Oracle, Microsoft, and SonicWall, and competed in the Pwn2Own exploitation competition. This DEF CON 33 talk represents the public disclosure of research that earned him a $40,000 prize at Pwn2Own Ireland.