SB2018102204 - Multiple vulnerabilities in NAS devices

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Privilege escalation (CVE-ID: CVE-2018-18471)

The vulnerability allows a remote attacker to compromise vulnerable system.

The weakness exists due to most of the API endpoints and the web interface were accessible without authentication while one of the endpoints in the REST API interface is located at /api/2.0/rest/aggregator/xml which loads xml data from POST data. A remote attacker cause the xml parser to make a request to the server at 192.168.56.1 for the file XXE_CHECK, get usernames and passwords, 
cause the daemon to skip over junk data until it finds the string as shown in the IDA snippet below and inject arbitrary commands and execute arbitrary code with root privileges.

2) Command injection (CVE-ID: CVE-2018-18472)

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The weakness exists in the language change and modify functionality in the REST API. A remote attacker can send a specially crafted request to inject and execute arbitrary commands with root privileges.

Note, the vulnerability is being actively exploited in the wild.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://www.wizcase.com/blog/hack-2018/
• https://www.westerndigital.com/support/productsecurity/wdc-21008-recommended-security-measures-wd-mybooklive-wd-mybookliveduo