CVE-2022-36534

What it actually does

Syncovery 9 for Linux versions 9.47x and earlier allow authenticated remote code execution through insufficient validation of the Job_ExecuteBefore and Job_ExecuteAfter fields handled by post_profilesettings.php. A user with access to modify job/profile settings can place operating-system command content into the pre-job or post-job execution parameters, causing the Syncovery service to execute attacker-controlled commands when the profile is saved or run. Because execution occurs in the context of the Syncovery service account, impact can include arbitrary command execution, data access, configuration tampering, persistence, lateral movement staging, and service disruption.

Why it matters to the business

A compromised Syncovery server can expose synchronized files, backup data, credentials, and connected storage locations, and can be used as a foothold to move into other systems that trust the synchronization workflow. The vulnerability has a high CVSS score, weaponized exploit maturity, and a high EPSS probability, so internet-accessible or broadly reachable Syncovery administrative interfaces should be treated as urgent even though the issue is not currently listed in CISA KEV and is not known from the provided data to be used in ransomware campaigns. The supplied product metadata appears inconsistent because it references Ubuntu Firefox fixed packages, while the vulnerability description applies to Syncovery for Linux; remediation programs should validate actual Syncovery exposure rather than relying on unrelated package records.

How an attack unfolds

An attacker first obtains valid credentials or access to a Syncovery account that can edit profile settings. They connect to the Syncovery web interface and submit a profile settings update to post_profilesettings.php with malicious content in the Job_ExecuteBefore or Job_ExecuteAfter parameter. The malicious value is stored as a pre-job or post-job command. When the synchronization profile is executed, Syncovery invokes the configured before/after action without adequate sanitization, causing the attacker’s command to run on the Linux host under the privileges of the Syncovery service. After code execution, the attacker may enumerate files and credentials used by synchronization jobs, exfiltrate data, deploy additional tooling, modify scheduled jobs for persistence, or disrupt synchronization operations.

How to fix it

Upgrade Syncovery 9 for Linux to a vendor-fixed release newer than 9.47x, or the latest supported Syncovery version, and confirm that the patch specifically addresses command execution through Job_ExecuteBefore and Job_ExecuteAfter in post_profilesettings.php. The fixed-version data supplied with this record references Ubuntu Firefox package version 77.0.1+build1-0ubuntu0.16.04.1, which does not match the described Syncovery vulnerability and should not be treated as remediation for this issue unless independently validated by package ownership and advisory mapping. Until upgraded, restrict network access to the Syncovery web interface, require strong authentication and MFA where supported, remove unnecessary users who can edit profiles, disable or tightly govern before/after job command features, review all existing profile pre/post execution settings, and run the service with the least privileges needed for synchronization. Place the service behind a VPN or trusted administrative network, and monitor or block suspicious profile-setting changes at a reverse proxy or WAF if immediate patching is not possible.

How to confirm the fix worked

Confirm the installed Syncovery version on Linux and verify it is later than 9.47x or matches the vendor’s patched release. Review package inventory, service banners, application About pages, and filesystem installation metadata for version evidence. Validate that post_profilesettings.php no longer accepts unsafe command content in Job_ExecuteBefore or Job_ExecuteAfter by performing controlled, non-destructive testing in an isolated environment. Inspect all configured profiles for unexpected pre-job or post-job commands, especially recently modified profiles. Confirm that the Syncovery web interface is not publicly exposed unless explicitly required and protected by strong access controls. Because the provided fixed-version metadata appears unrelated to Syncovery, also verify vulnerability scanner mappings and SBOM/package records for false associations before closing remediation tickets.

Typical attack path

1. Identify a reachable Syncovery 9 for Linux web interface or administrative endpoint.
2. Authenticate with a valid low-privileged or stolen Syncovery account that can edit synchronization profile settings.
3. Submit a POST request to post_profilesettings.php that modifies Job_ExecuteBefore or Job_ExecuteAfter with attacker-controlled command content.
4. Trigger the affected synchronization profile manually or wait for its scheduled execution.
5. Gain command execution as the Syncovery service account on the Linux host.
6. Enumerate synchronized paths, stored connection secrets, backup targets, and local files accessible to the service.
7. Establish persistence through modified Syncovery jobs, cron/systemd entries, SSH keys, or dropped scripts if permissions allow.
8. Use the host as a staging point for data theft, credential harvesting, lateral movement, or operational disruption.

How to detect it

To determine whether exploitation already occurred, review Syncovery application logs, web server or reverse proxy access logs, authentication logs, Linux audit logs, EDR process telemetry, shell history, and file integrity data from affected hosts. Look for POST requests to post_profilesettings.php containing Job_ExecuteBefore or Job_ExecuteAfter, especially values with shell metacharacters, encoded payloads, interpreter invocations, download utilities, or outbound network commands. Correlate profile-setting changes with subsequent job executions and child processes spawned by the Syncovery service. Investigate Syncovery-related processes launching /bin/sh, /bin/bash, python, perl, ruby, php, curl, wget, nc, ncat, socat, ssh, chmod, chattr, crontab, systemctl, or base64. Review profile configuration files or exported settings for unexpected before/after commands. Check for newly created scripts in temporary or writable directories, new cron entries, systemd service files, SSH authorized_keys modifications, unusual archive creation, and outbound connections to unfamiliar IPs immediately after profile edits or sync runs. If logs are limited, focus on timestamp correlation between profile modifications, Syncovery job execution, and unusual child process or network activity from the Syncovery host.

• post_profilesettings.php
• Job_ExecuteBefore
• Job_ExecuteAfter
• POST /post_profilesettings.php
• Job_ExecuteBefore=
• Job_ExecuteAfter=
• Job_ExecuteBefore%3D
• Job_ExecuteAfter%3D
• /bin/sh
• /bin/bash
• /usr/bin/curl
• /usr/bin/wget
• /usr/bin/nc
• /usr/bin/ncat
• /usr/bin/socat
• /usr/bin/python
• /usr/bin/python3
• /usr/bin/perl
• /usr/bin/php
• /usr/bin/base64
• /usr/bin/crontab
• /bin/systemctl
• authorized_keys
• /etc/cron.d/
• /etc/systemd/system/
• /tmp/
• /var/tmp/
• syncovery

What your security team should do

• Prioritize identification and patching of Syncovery 9 for Linux instances at or below 9.47x, especially internet-accessible systems or systems with access to sensitive backup and synchronization destinations.
• Treat this as high urgency because exploit maturity is listed as weaponized and EPSS is high, despite the absence of CISA KEV status in the provided data.
• Validate asset inventory carefully because the supplied affected-product and fixed-version metadata references Ubuntu Firefox and may represent a mismapped package record.
• Immediately review Syncovery profile settings for suspicious Job_ExecuteBefore and Job_ExecuteAfter values and remove any unexpected commands.
• Restrict Syncovery administrative access to trusted networks, VPNs, or privileged access gateways; remove direct public exposure where possible.
• Audit Syncovery users and permissions, rotate credentials for accounts with profile-editing access, and disable unused accounts.
• Enable detailed application, web access, and Linux process auditing around Syncovery until all instances are patched and reviewed.
• Investigate any Syncovery service spawning shells, interpreters, download tools, network utilities, or unexpected child processes.
• Rotate secrets used by synchronization jobs if compromise is suspected, including cloud storage tokens, SFTP keys, SMB credentials, and backup repository credentials.
• Hunt for persistence or post-exploitation artifacts such as modified sync profiles, new cron jobs, systemd services, SSH keys, dropped scripts, and unusual outbound connections from Syncovery hosts.