Western Digital My Cloud 2.21.119 Authentication Bypass

`------------------------------------------------------------------------  
Authentication bypass vulnerability in Western Digital My Cloud  
------------------------------------------------------------------------  
Remco Vermeulen, Januari 2017  
  
------------------------------------------------------------------------  
Abstract  
------------------------------------------------------------------------  
It was discovered that Western Digital My Cloud is affected by an  
authentication bypass vulnerability. By exploiting this vulnerability,  
an unauthenticated attacker can bypass the login functionality and gain  
full control of the device.  
  
------------------------------------------------------------------------  
Tested versions  
------------------------------------------------------------------------  
This vulnerability was successfully verified on a Western Digital My  
Cloud model WDBCTL0020HWT running firmware version 2.21.119. This issue  
isn't limited to the model that was used to find this vulnerability  
since most of the products in the My Cloud series share the same  
(vulnerable) code.  
  
------------------------------------------------------------------------  
Fix  
------------------------------------------------------------------------  
Western Digital has released firmware version 2.21.126 that resolves  
this vulnerability. This updated firmware can be downloaded from the  
following location:  
https://support.wdc.com/downloads.aspx?g=904&lang=en#firmware  
  
------------------------------------------------------------------------  
Details  
------------------------------------------------------------------------  
https://www.securify.nl/advisory/SFY20170102/authentication_bypass_vulnerability_in_western_digital_my_cloud.html  
  
The authentication bypass is possible because the login_check() function first checks if a user is authenticated by looking at the user's session. If the session parameter username is not present the login_check() function performs a check to verify if the cookies username and isAdmin are set. If this is the case, login_check() assumes that the user is logged in (and/or is an administrator). Simply sending a request with the two mentioned cookies and without a session cookie is sufficient for accessing My Cloud as an admin user.  
  
The following code fragment shows the vulnerable code, which can be found in /web/lib/login_checker.php:  
  
function login_check()  
{  
$ret = 0;  
  
if (isset($_SESSION['username']))  
{  
if (isset($_SESSION['username']) && $_SESSION['username'] != "")  
$ret = 2; //login, normal user  
  
if ($_SESSION['isAdmin'] == 1)  
$ret = 1; //login, admin  
}  
else if (isset($_COOKIE['username']))  
{  
if (isset($_COOKIE['username']) && $_COOKIE['username'] != "")  
$ret = 2; //login, normal user  
  
if ($_COOKIE['isAdmin'] == 1)  
$ret = 1; //login, admin  
}  
  
return $ret;  
}  
`