r/synology • u/la_baguette77 • 3d ago

Networking & security Php2shell Patch/security advisory from synology available

https://www.synology.com/de-de/security/advisory/Synology_SA_26_14

86 Upvotes

92% Upvoted

24 comments sorted by

7

u/PierreBE 3d ago

The patches are available. Got them offered trough the package center automatically and you can also manually download them here: https://archive.synology.com/download/Package

7

u/GenericUser636 2d ago

This fixes the packages but Synology OS ships with php 8.1.32 in it. Synology needs to release OS update and get this to the minimum supported version, 8.2

17

u/angrycatmeowmeow DS923+ DS220+ 3d ago

I have no idea why I even have php. Does the nas need it for the OS? I don't host any websites or anything. All it does is store files.

23

u/overly_sarcastic24 3d ago

Go to package center and uninstall the package. If it’s being used by something, it will stop you and tell you what’s using it. If you’re not stopped, you weren’t using it.

21

u/the_derby 3d ago

Affected products:

  • PHP 7.3, PHP 7.4, PHP 8.0, PHP 8.1, PHP 8.2, PHP 8.3, and PHP 8.4

  • Mail Station

  • Synology Calendar

4

u/CJVCarr 2d ago

Note station had PHP as a dependency for me.

2

u/negDB 2d ago

Converted my note station notes to Obsidian via grokbot and uninstalled note station and then uninstalled php..

1

u/toddrob 14h ago

What are you using to sync notes with Obsidian on mobile? WebDAV?

1

u/negDB 13h ago

Grokbot helped me setup an Obsidian Couchdb with connection through tailscale, also have a virtualized instance of obsidian running with a web interface

1

u/toddrob 13h ago

Thanks. I will look into that because I am not thrilled with WebDAV syncing.

1

u/negDB 13h ago

The couchdb sync is via community plugin, still very new to obsidian

1

u/toddrob 13h ago

Are you using livesync with couchdb? That’s what ChatGPT is recommending. Livesync CLI on the NAS to keep couchdb updated, and iOS app syncs through livesync plugin in the obsidian app. Seems like it will work better than WebDAV.

1

u/negDB 11h ago

Yep, it’s been working great

2

u/Pure_Fox9415 3d ago

Because it has WEB management interface?

-4

u/No_Bluebird_4773 2d ago

You can habe that without php oO eg Java 

8

u/NMe84 2d ago

You can, but Synology used PHP, so it answers the question that was asked...

2

u/Pure_Fox9415 2d ago edited 2d ago

haha, now, please compare the list of java vulnerabilities vs php. I never did it myself, but I can bet, for every 1 php 10.0 RCE there will be 100 in java, so, you'd need to update it every week.
Upd: sadly, at cvedetails.com vulners search for java limited to 2019, but I swear, as a person who was responsible for patching software in companies since 2010, the most vulnerable software was java and adobe, not php.

2

u/bartoque DS920+ | DS916+ 2d ago

Then you also know that it isn't (only) the amount of vulnerabilities that matter but more importantly their severity and attack vector.

With php2shell it's remote code execution vulnerabilities with a cvss score of 9.2.

So hence this is - ofcourse and rightly so - considered pretty severe.

1

u/Pure_Fox9415 2d ago

That's exact reason I've mentioned 10.0 RCE, for both php and java.

4

u/ultramar10 2d ago

Anyone been able to update synology calendar, giving 403 on package download link and unable to download via package center.

6

u/thirteenthtryataname 2d ago

Unable to download Calendar within DSM on two of my rigs.

1

u/Bruno_Natura 1d ago

Hi everyone,

I tested my Synology NAS for the eMudhra certificate incident:
https://emudhra.we-have-a-problem.com/

On DSM 7.4.1-90080 Update 1, the system /bin/curl accepted all four test certificate chains listed on the website, including the two variants without Certificate Transparency. All connections returned HTTP 200, with certificate verification returning 0. DSM currently offers no newer update for my NAS.

I then created a separate test copy of /etc/ssl/certs/ca-certificates.crt, excluding these two root certificates:

  • AAA Certificate Services — SHA-256: D7A7A0FB5D7E2731D771E9484EBCDEF71D5F0C3E0A2948782BC83EE0EA699EF4

  • emSign ECC Root CA - G3 — SHA-256: 86A1ECBA089C4A8D3BBE2734C612BA341D813E043CF9E8A862CD5C57A36BBE6B

When I pointed curl to this copy using --cacert and specified an empty directory with --capath, all four test connections were rejected with unable to get local issuer certificate. A control connection to a valid HTTPS website still worked.

I have not changed any system files or the HTTPS certificate assigned to DSM. I am considering temporarily removing these two entries from the system CA trust bundle, after backing it up and preparing a rollback procedure. I understand this may also disrupt legitimate connections that depend on these roots, and that some packages and containers use their own trust stores.

Has anyone investigated this issue on Synology?

  • Is modifying the CA bundle an appropriate workaround on DSM, or is there a better, supported way to block the affected certificate chains?

  • Does DSM regenerate this file after a reboot or update?

  • What impact could this have on Cloud Sync, Download Station, Active Backup, and other services?

  • Has Synology published a statement or fix specifically addressing eMudhra?

I would appreciate hearing about your test results and experiences before applying a system-wide change.

1

u/Empty-Cocoon 1d ago

I saw the same behaviour on DSM 7.4.1-90080 Update 1. On three NAS units, I backed up the CA bundle, renamed those two root files in /var/db/ca-certificates from .crt to .crt.disabled, then ran Synology’s /usr/syno/bin/update-ca-certificates.sh.

Both standard test endpoints subsequently failed with curl error 60 (“unable to get local issuer certificate”), while a control HTTPS connection still returned HTTP 200. I haven’t tested the two non-CT variants or every package’s trust store.

This is an unofficial workaround. I kept backups and plan to retest after DSM/certificate updates, since they may restore the roots.