Description
在Synology BeeStation OS (BSM)和Synology DiskStation Manager (DSM)的webapi组件中存在一个漏洞，该漏洞是由于输出没有正确编码或转义导致的。攻击者可以通过未指定的向量读取受限文件。
Synology BeeStation OS/DSM /webapi/entry.cgi 文件读取漏洞（CVE-2024-50629）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-50629
https://www.synology.com/en-global/security/advisory/Synology_SA_24_20
https://github.com/advisories/GHSA-xwc2-pv6j-7344
https://kiddo-pwn.github.io/blog/2025-11-30/writing-sync-popping-cron
https://www.zerodayinitiative.com/advisories/ZDI-25-211/
https://cyberpress.org/multiple-synology-beestation-vulnerabilities-chained-to-achieve-root-privileges-by-weaponizing-the-systems-task-scheduler/
https://access.redhat.com/security/cve/cve-2024-50629
https://www.cve.org/CVERecord?id=CVE-2024-50629