A deep technical write-up of the Synology BeeStation pre-auth-to-RCE chain disclosed by DEVCORE at Pwn2Own Ireland 2024 (CVE-2024-50629 CRLF injection, CVE-2024-50630 auth bypass via webapi-to-syncd domain-socket trust, CVE-2024-50631 SQL injection in update_settings) plus an N-day variant by Kiddo that swaps DEVCORE’s PHP-based RCE for a novel "ATTACH DATABASE" primitive against "/etc/cron.d/pwn.task", exploiting cron’s line-skip tolerance to embed a working reverse-shell crontab inside an otherwise-binary SQLite file. https://core-jmp.org/2026/05/kiddo-pwn-synology-beestation-sqlite-cron-rce-cve-2024-50629-50631/ #ATTACHDATABASE #AuthenticationBypass #BeeStation #CommandInjection #CRLFInjection #CronAbuse #CVE #CVE202450629 #CVE202450630 #CVE202450631 #NdayResearch #Pwn2Own #RCE #SQLInjection #SQLite #Synology #SynologyDriveServer #UnauthenticatedRCE #VulnerabilityResearch #XAccelRedirect
Post summary
The post presents a detailed, technical disclosure of Synology BeeStation CVEs, outlining their attack chain and an N‑day variant, but it does not mention active exploitation, patches, or debunking.