SB2017120506 - Multiple vulnerabilities in Western Digital My Cloud

Description

This security bulletin contains information about 5 secuirty vulnerabilities.

1) Hidden functionality (backdoor) (CVE-ID: N/A)

The vulnerability allows a remote attacker to gain unauthorized access to vulnerable device.

The vulnerability exists due to presence of a backdoor code (hard-coded account credentials) in firmware shared by WD My Cloud and D-LINK DNS-320L ShareCenter software. A remote attacker can send a specially crafted HTTP GET request to the affected device and gain unauthorized access to it.

Exploitation example:

 GET /cgi-bin/nas_sharing.cgi?dbg=1&cmd=51&user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&start=1&count=1;touch+/tmp/gulftech; HTTP/1.1

where login is "mydlinkBRionyg" and password is "abc12345cba".

List of affected Western Digital devices:

               MyCloud
               MyCloudMirror
               My Cloud Gen 2
               My Cloud PR2100
               My Cloud PR4100
               My Cloud EX2 Ultra
               My Cloud EX2
               My Cloud EX4
               My Cloud EX2100
               My Cloud EX4100
               My Cloud DL2100
               My Cloud DL4100
               My Cloud DL4100

Note: this vulnerability was updated according to GulfTech advisory. Vulnerability severity is raised to critical and this vulnerability is being treated as a zero-day.

2) Unrestricted file upload (CVE-ID: N/A)

The vulnerability allows a remote attacker to compromise vulnerable device.

The vulnerability exists due to improper validation of file extension in "/usr/local/modules/web/pages/jquery/uploader/multi_uploadify.php" scrpit before uploading files via the "/mydlink/mydlink.cgi" URI. A remote unauthenticated attacker can send a specially crafted HTTP POST request to vulnerable device and upload arbitrary file on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable device.

Note: description of this vulnerability was updated according to GulfTech advisory.

3) Cross-site request forgery (CVE-ID: N/A)

The vulnerability allows a remote attacker to perform CSRF attacks.

The vulnerability exists due to improper validation of the request origin when processing HTTP requests to "/web/dsdk/DsdkProxy.php" script. A remote attacker can create a specially crafted website, trick the victim into opening it and delete all files on the system.

Exploitation example:

 http://[host]/web/dsdk/DsdkProxy.php?;rm -rf /; 

4) Improper access control (CVE-ID: N/A)

The vulnerability allows a remote attacker to gain access to potentially sensitive data.

The vulnerability exists due to absent validation of the access credentials before displaying the list of all application users via "/api/2.1/rest/users" API. A remote unauthenticated attacker can send a simple HTTP GET request an view the list of all device users.

Exploitation example:

GET /api/2.1/rest/users? HTTP/1.1

5) Insecure library loading (CVE-ID: CVE-2017-7494)

The vulnerability allows a remote authenticated attacker to execute arbitrary code on vulnerable server.

The vulnerability exists due to insecure library loading mechanism, when processing files on file shares. A remote attacker with ability to upload file on SMB share can upload and execute arbitrary shared library on the server with privileges of the Samba process.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Remediation

Install update from vendor's website.

References

• https://support.wdc.com/download/notes/WD_My_Cloud_Firmware_Release_Notes_2.30.172.pdf?v=987
• http://gulftech.org/advisories/WDMyCloud%20Multiple%20Vulnerabilities/125
• https://www.samba.org/samba/security/CVE-2017-7494.html