PT-2018-13926 · Western Digital · Western Digital My Cloud

Remco Vermeulen · Published 2018-09-18 · Updated 2023-07-28 · CVE-2018-17153

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Western Digital My Cloud versions prior to 2.30.196

Description The issue allows an unauthenticated attacker to bypass authentication and gain full control of the device by exploiting a vulnerability in the authentication mechanism. Specifically, the network mgr.cgi CGI module contains a command called "cgi get ipv6" that can start an admin session tied to the user's IP address if a certain parameter is provided. This enables an attacker to invoke commands that normally require admin privileges without needing to provide a password. The vulnerability exploits the way server-side sessions are created and bound to a user's IP address when an admin logs in.

Recommendations For versions prior to 2.30.196, update to version 2.30.196 or later to resolve the issue. As a temporary workaround, consider restricting access to the network mgr.cgi CGI module to minimize the risk of exploitation. Avoid using the cgi get ipv6 command with the flag parameter set to 1 until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-17153

Affected Products

Western Digital My Cloud

References · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/wd_mycloud_unauthenticated_cmd_injection.rb · Exploit
• 🔥 https://securify.nl/nl/advisory/SFY20180102/authentication-bypass-vulnerability-in-western-digital-my-cloud-allows-escalation-to-admin-privileges.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-17153 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17153 · Security Note
• http://packetstormsecurity.com/files/173802/Western-Digital-MyCloud-Unauthenticated-Command-Injection.html · Note
• http://securityfocus.com/bid/105359 · Note
• https://support.wdc.com/knowledgebase/answer.aspx?ID=25952 · Note