SYNOLOGY DSM 7.3.2

Summary from the TLDR InfoSec newsletter

A local privilege escalation vulnerability chain in Synology DSM 7.3.2-86009 allows any authenticated user with shell access to gain root when DownloadStation with BitTorrent is enabled. The exploit chains three misconfigurations: a world-writable Transmission RPC socket running as root, a world-writable /volume1/@eaDir/ system directory, and a missing nosuid mount flag on /volume1, enabling attackers to configure Transmission's script-torrent-done-filename to execute arbitrary payloads as root upon torrent completion. A full PoC is available, and the vulnerability has been reported to Synology PSIRT.