Multiple vulnerabilities in Western Digital My Cloud Home & Duo firmware



Risk High
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2023-4154
CVE-2023-38545
CVE-2023-38546
CWE-ID CWE-200
CWE-122
CWE-73
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Vulnerable software
My Cloud Home Duo
Client/Desktop applications / Other client software

My Cloud Home
Client/Desktop applications / Other client software

Vendor Western Digital

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU81874

Risk: Medium

CVSSv4.0: [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-4154

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to a design error in Samba's implementation of the DirSync control, which can allow replication of critical domain passwords and secrets by Active Directory accounts authorized to do some replication, but not to replicate sensitive attributes. A remote user can obtain sensitive information from the AD DC and compromise the Active Directory.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Home Duo: 9.4.0-191 - 9.6.0-111

My Cloud Home: 9.4.0-191 - 9.6.0-111

CPE2.3 External links

http://www.westerndigital.com/support/product-security/wdc-24007-western-digital-my-cloud-home-and-duo-firmware-9-7-0-104


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Heap-based buffer overflow

EUVDB-ID: #VU81865

Risk: High

CVSSv4.0: [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber]

CVE-ID: CVE-2023-38545

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the SOCKS5 proxy handshake. A remote attacker can trick the victim to visit a malicious website, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system but requires that SOCKS5 proxy is used and that SOCKS5 handshake is slow (e.g. under heavy load or DoS attack).

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Home Duo: 9.4.0-191 - 9.6.0-111

My Cloud Home: 9.4.0-191 - 9.6.0-111

CPE2.3 External links

http://www.westerndigital.com/support/product-security/wdc-24007-western-digital-my-cloud-home-and-duo-firmware-9-7-0-104


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

3) External control of file name or path

EUVDB-ID: #VU81863

Risk: Low

CVSSv4.0: [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-38546

CWE-ID: CWE-73 - External Control of File Name or Path

Exploit availability: No

Description

The vulnerability allows an attacker to inject arbitrary cookies into request.

The vulnerability exists due to the way cookies are handled by libcurl. If a transfer has cookies enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned version of the handle would instead store the file name as none (using the four ASCII letters, no quotes).

Subsequent use of the cloned handle that does not explicitly set a source to load cookies from would then inadvertently load cookies from a file named none - if such a file exists and is readable in the current directory of the program using libcurl.

Mitigation

Install update from vendor's website.

Vulnerable software versions

My Cloud Home Duo: 9.4.0-191 - 9.6.0-111

My Cloud Home: 9.4.0-191 - 9.6.0-111

CPE2.3 External links

http://www.westerndigital.com/support/product-security/wdc-24007-western-digital-my-cloud-home-and-duo-firmware-9-7-0-104


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###