Multiple vulnerabilities in Western Digital My Cloud

Published: 2017-12-05 | Updated: 2023-03-30

Risk	Critical
Patch available	YES
Number of vulnerabilities	5
CVE-ID	CVE-2017-7494
CWE-ID	CWE-912 CWE-434 CWE-352 CWE-284 CWE-426
Exploitation vector	Network
Public exploit	Vulnerability #1 is being exploited in the wild. Public exploit code for vulnerability #2 is available. Public exploit code for vulnerability #3 is available. Public exploit code for vulnerability #4 is available. Vulnerability #5 is being exploited in the wild.
Vulnerable software Subscribe	WD My Cloud Hardware solutions / Office equipment, IP-phones, print servers
Vendor	Western Digital

Security Bulletin

This security bulletin contains information about 5 vulnerabilities.

1) Hidden functionality (backdoor)

EUVDB-ID: #VU9871

Risk: Critical

CVSSv3.1: 9.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-912 - Hidden Functionality (Backdoor)

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to vulnerable device.

The vulnerability exists due to presence of a backdoor code (hard-coded account credentials) in firmware shared by WD My Cloud and D-LINK DNS-320L ShareCenter software. A remote attacker can send a specially crafted HTTP GET request to the affected device and gain unauthorized access to it.

Exploitation example:

 GET /cgi-bin/nas_sharing.cgi?dbg=1&cmd=51&user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&start=1&count=1;touch+/tmp/gulftech; HTTP/1.1

where login is "mydlinkBRionyg" and password is "abc12345cba".

List of affected Western Digital devices:

               MyCloud
               MyCloudMirror
               My Cloud Gen 2
               My Cloud PR2100
               My Cloud PR4100
               My Cloud EX2 Ultra
               My Cloud EX2
               My Cloud EX4
               My Cloud EX2100
               My Cloud EX4100
               My Cloud DL2100
               My Cloud DL4100
               My Cloud DL4100

Note: this vulnerability was updated according to GulfTech advisory. Vulnerability severity is raised to critical and this vulnerability is being treated as a zero-day.

Mitigation

Update to version 2.30.172.

Vulnerable software versions

WD My Cloud: 2.10.302 - 2.30.165

External links

http://support.wdc.com/download/notes/WD_My_Cloud_Firmware_Release_Notes_2.30.172.pdf?v=987
http://gulftech.org/advisories/WDMyCloud%20Multiple%20Vulnerabilities/125

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

2) Unrestricted file upload

EUVDB-ID: #VU9872

Risk: High

CVSSv3.1: 9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable device.

The vulnerability exists due to improper validation of file extension in "/usr/local/modules/web/pages/jquery/uploader/multi_uploadify.php" scrpit before uploading files via the "/mydlink/mydlink.cgi" URI. A remote unauthenticated attacker can send a specially crafted HTTP POST request to vulnerable device and upload arbitrary file on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable device.

Note: description of this vulnerability was updated according to GulfTech advisory.

Mitigation

Update to version 2.30.172.

Vulnerable software versions

WD My Cloud: 2.10.302 - 2.30.165

External links

http://support.wdc.com/download/notes/WD_My_Cloud_Firmware_Release_Notes_2.30.172.pdf?v=987
http://gulftech.org/advisories/WDMyCloud%20Multiple%20Vulnerabilities/125

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) Cross-site request forgery

EUVDB-ID: #VU9873

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform CSRF attacks.

The vulnerability exists due to improper validation of the request origin when processing HTTP requests to "/web/dsdk/DsdkProxy.php" script. A remote attacker can create a specially crafted website, trick the victim into opening it and delete all files on the system.

Exploitation example:

 http://[host]/web/dsdk/DsdkProxy.php?;rm -rf /;

Mitigation

Update to version 2.30.172.

Vulnerable software versions

WD My Cloud: 2.10.302 - 2.30.165

External links

http://support.wdc.com/download/notes/WD_My_Cloud_Firmware_Release_Notes_2.30.172.pdf?v=987
http://gulftech.org/advisories/WDMyCloud%20Multiple%20Vulnerabilities/125

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Improper access control

EUVDB-ID: #VU9874

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive data.

The vulnerability exists due to absent validation of the access credentials before displaying the list of all application users via "/api/2.1/rest/users" API. A remote unauthenticated attacker can send a simple HTTP GET request an view the list of all device users.

Exploitation example:

GET /api/2.1/rest/users? HTTP/1.1

Mitigation

Update to version 2.30.172.

Vulnerable software versions

WD My Cloud: 2.10.302 - 2.30.165

External links

http://support.wdc.com/download/notes/WD_My_Cloud_Firmware_Release_Notes_2.30.172.pdf?v=987
http://gulftech.org/advisories/WDMyCloud%20Multiple%20Vulnerabilities/125

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

5) Insecure library loading

EUVDB-ID: #VU6676

Risk: Medium

CVSSv3.1: 8.6 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C]

CVE-ID: CVE-2017-7494

CWE-ID: CWE-426 - Untrusted Search Path

Exploit availability: Yes

Description

The vulnerability allows a remote authenticated attacker to execute arbitrary code on vulnerable server.

The vulnerability exists due to insecure library loading mechanism, when processing files on file shares. A remote attacker with ability to upload file on SMB share can upload and execute arbitrary shared library on the server with privileges of the Samba process.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

The vulnerability is fixed in versions: 4.6.4, 4.5.10 and 4.4.14.

Vulnerable software versions

WD My Cloud: 2.10.302 - 04.05.00-315

External links

http://www.samba.org/samba/security/CVE-2017-7494.html

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.