Server-Side Request Forgery (SSRF) in Western Digital products - CVE-2023-22817

Vulnerability identifier: #VU86123

CSH Severity: High

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:N/SA:N]

CVE-ID: CVE-2023-22817

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote attacker to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input within the RESTSDK server. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

My Cloud PR2100
My Cloud PR4100
My Cloud EX4100
My Cloud EX2 Ultra
My Cloud Mirror G2
My Cloud DL2100
My Cloud DL4100
My Cloud EX2100
WD Cloud
My Cloud (Glacier)
My Cloud Home
My Cloud Home Duo
SanDisk ibi

Install updates from vendor's website.

My Cloud PR2100 - update to 5.27.161
My Cloud PR4100 - update to 5.27.161
My Cloud EX4100 - update to 5.27.161
My Cloud EX2 Ultra - update to 5.27.161
My Cloud Mirror G2 - update to 5.27.161
My Cloud DL2100 - update to 5.27.161
My Cloud DL4100 - update to 5.27.161
My Cloud EX2100 - update to 5.27.161
My Cloud (Glacier) - update to 5.27.161
WD Cloud - update to 5.27.161
My Cloud Home - update to 9.5.1-104
My Cloud Home Duo - update to 9.5.1-104
SanDisk ibi - update to 9.5.1-104

• https://www.westerndigital.com/support/product-security/wdc-24001-western-digital-my-cloud-os-5-my-cloud-home-duo-and-sandisk-ibi-firmware-update
• https://www.zerodayinitiative.com/advisories/ZDI-24-087/

• Multiple vulnerabilities in Western Digital My Cloud OS 5, My Cloud Home and SanDisk ibi devices