PT-2024-5724 · Western Digital · Wd Discovery

Abdulkarim + 2 · Published 2024-08-02 · Updated 2024-09-12 · CVE-2024-22169

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WD Discovery versions prior to 5.0.589

Description The issue is related to a misconfiguration in the Node.js environment settings of WD Discovery, which could allow code execution by utilizing the ELECTRON RUN AS NODE environment variable. Any malicious application operating with standard user permissions can exploit this, enabling code execution within the WD Discovery application's context. The attack vector requires the victim to have the WD Discovery app installed on their device.

Recommendations For versions prior to 5.0.589, update to version 5.0.589, which addresses this issue by disabling certain features and fuses in Electron. As a temporary workaround, consider restricting access to the ELECTRON RUN AS NODE environment variable to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2024-06437

CVE-2024-22169

Affected Products

Wd Discovery

References · 8

• https://bdu.fstec.ru/vul/2024-06437 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-22169 · Security Note
• https://twitter.com/Komodosec/status/1834292425352999119 · Twitter Post
• https://t.me/pentestingnews/50021 · Telegram Post
• https://westerndigital.com/support/product-security/wdc-24004-wd-discovery-desktop-app-version-5-0-589 · Note
• https://vuldb.com/ru/?id.273507 · Note
• https://twitter.com/Brandefense/status/1822921616440926635 · Twitter Post
• https://t.me/cvedetector/2374 · Telegram Post