Severe vulnerability in the Western Digital My Cloud service that would allow an attacker to gain access

A significant vulnerability has been discovered in Western Digital My Cloud services that could be easily exploited by expert attackers.

One of the biggest headaches for businesses is security issues, especially breaches that can compromise sensitive user data. The last to be compromised was Western Digital My Cloud, which would have a significant vulnerability in authentication. A malicious attacker could gain access with administration permissions by offering disk access through the web portal without entering a password, gaining control of the My Cloud device.

Important security hole in the Western Digital My Cloud service.

This vulnerability has been verified in the WDBCTL0200HWT model, which would have firmware version 2.30.172. The problem is not limited only to the mentioned model, it would affect the majority of My Cloud devices which share the same code and therefore all have the same security problem.

UPDATE:

Hi, just a heads up, the recently reported vulnerability in the My Cloud firmware has been addressed with a user-installable hotfix found here: https://t.co/hKtWb1kB75 This will be included in an over-the-air update as part of the normal upgrade schedule for these products

— Western Digital (@westerndigital) September 23, 2018

WD My Cloud devices are network-connected storage units that offer a great solution for offices and work centers. The vulnerability allows it to be exploited by malicious users with the appropriate knowledge, allowing easy access to the web and allowing the creation of an administrator session that is linked to the IP.

Exploiting this vulnerability allows attackers to execute commands that normally require administrator privileges and thus gain complete control of the My Cloud device. It has been discovered thanks to the reverse engineering of the CGI binaries to find security problems.

When we connect as an administrator, a session is created on the server linked to the user's IP. When it is created, it is possible to call the authenticated CGI modules sent by the username-admin cookie regarding the HTTP request. The invoked CGI will verify the valid session is registered and is linked to the user's IP.

It has been found that the unknown attacker can create a valid session without requiring the requirement to start a new session. The CGI networ_mgr.cgi has the cgi_get_ipv6 command that does the administrator login function that binds the IP address of the user making the request when the parameter flag is invoked equals 1. The following command call, usually requires administrator privileges that would be allowed if an attacker sets the username = admin cookies. Simple enough for hackers.

Source: G3D