Description

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write restricted files and conduct limited denial-of-service attacks in DSM.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-28T08:16:59.063Z",
  "pubdate": "2026-08-28T08:16:59.063Z",
  "executiveSummary": "An improper neutralization of input vulnerability exists within the domain extraction functionality of the Synology Chat Server. This flaw is classified as a Cross-Site Scripting (XSS) vulnerability, enabling remote authenticated attackers to execute malicious scripts within the context of a user's session.\nThe vulnerability affects Synology Chat Server versions prior to 2.4.5-22148. By leveraging specific UI interactions, an attacker can bypass security boundaries to access or modify restricted files within the DiskStation Manager (DSM) environment.\nThe risk implications are significant, as successful exploitation facilitates unauthorized data access and the potential for limited denial-of-service (DoS) conditions. Because the attack requires a remote authenticated user, the vulnerability represents a critical escalation vector for malicious actors who have gained valid credentials to the Chat Server. Exploitation is predicated on the target interacting with the manipulated UI element, which triggers the execution of the injected payload.",
  "technicalDetails": "The vulnerability originates from improper neutralization of user-supplied input during the domain extraction process within the Synology Chat Server application. Specifically, the component responsible for parsing and displaying domains fails to adequately sanitize input, allowing for the injection of arbitrary script content.\nThe attack flow begins when an authenticated remote attacker supplies a malicious string designed to be processed by the domain extraction logic. When a user interacts with the compromised UI element in the Synology Chat interface, the application reflects the unvalidated input back to the browser session. Because the content is not properly escaped or sanitized, the browser interprets the injected script as legitimate code executed within the context of the DSM web interface.\nBy executing scripts in the context of an authenticated session, the attacker inherits the victim's permissions. This allows the attacker to perform unauthorized actions such as reading sensitive files, modifying restricted configurations, or triggering operations that induce a denial-of-service state within the DSM environment.\nThe vulnerable component is identified as the domain extraction module of the Synology Chat Server. The issue affects all versions prior to 2.4.5-22148. Successful exploitation requires the attacker to be authenticated to the Chat Server and rely on a UI interaction (triggering) by the victim to execute the payload. The lack of robust Content Security Policy (CSP) enforcement or rigorous output encoding during the parsing of domains permits the bypass of standard browser-side protection mechanisms, leading to persistent or reflected script execution that can compromise the integrity and availability of the underlying DSM platform."
}