Vulnerability in WD My Cloud - not a zero-day

Hidden functionality (backdoor)

Hardcoded credentials were detected in firmware shared by D-Link DNS-320 L and WD My Cloud. The issue was brought up by researchers from GulfTech in the beginning of January 2018, while the vendor has patched the vulnerability in November 2017.

Given the age of code that contained the backdoor we tend to believe that this issue has being exploited in the wild. Therefore we track this vulnerability as a zero-day.

Vulnerability details

Advisory: SB2017120506 - Multiple vulnerabilities in Western Digital My Cloud

Vulnerable component: WD My Cloud

CVE-ID:

CVSSv3 score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C

CWE-ID: CWE-912 - Hidden Functionality (Backdoor)

Description:

The vulnerability allows a remote attacker to gain unauthorized access to vulnerable device.

The vulnerability exists due to presence of a backdoor code (hard-coded account credentials) in firmware shared by WD My Cloud and D-LINK DNS-320L ShareCenter software. A remote attacker can send a specially crafted HTTP GET request to the affected device and gain unauthorized access to it.

Exploitation example:

 GET /cgi-bin/nas_sharing.cgi?dbg=1&cmd=51&user=mydlinkBRionyg&passwd=YWJjMTIzNDVjYmE&start=1&count=1;touch+/tmp/gulftech; HTTP/1.1

where login is "mydlinkBRionyg" and password is "abc12345cba".

List of affected Western Digital devices:

               MyCloud
               MyCloudMirror
               My Cloud Gen 2
               My Cloud PR2100
               My Cloud PR4100
               My Cloud EX2 Ultra
               My Cloud EX2
               My Cloud EX4
               My Cloud EX2100
               My Cloud EX4100
               My Cloud DL2100
               My Cloud DL4100
               My Cloud DL4100

Note: this vulnerability was updated according to GulfTech advisory. Vulnerability severity is raised to critical and this vulnerability is being treated as a zero-day.