Abstract
It was discovered that Western Digital My Cloud is affected by an authentication bypass vulnerability. By exploiting this vulnerability, an unauthenticated attacker can bypass the login functionality and gain full control of the device.
Tested versions
This vulnerability was successfully verified on a Western Digital My Cloud model WDBCTL0020HWT running firmware version 2.21.119. This issue isn't limited to the model that was used to find this vulnerability since most of the products in the My Cloud series share the same (vulnerable) code.
Fix
Western Digital has released firmware version 2.21.126 that resolves this vulnerability. This updated firmware can be downloaded from the following location: https://support.wdc.com/downloads.aspx?g=904&lang=en#firmware
Introduction
Western Digital My Cloud is low-cost entry-level network-attached storage device. An authentication bypass vulnerability was found in My Cloud that allows an unauthenticated attacker to bypass the login functionality and gain administrative access to the My Cloud web interface. This effectively gives an attacker full control of the device.
This vulnerability was independently discovered by Kacper Szurek, which is also detailed in his security advisory.
Details
The authentication bypass is possible because the login_check() function first checks if a user is authenticated by looking at the user's session. If the session parameter username is not present the login_check() function performs a check to verify if the cookies username and isAdmin are set. If this is the case, login_check() assumes that the user is logged in (and/or is an administrator). Simply sending a request with the two mentioned cookies and without a session cookie is sufficient for accessing My Cloud as an admin user.
The following code fragment shows the vulnerable code, which can be found in /web/lib/login_checker.php:
function login_check()
{
$ret = 0;
if (isset($_SESSION['username']))
{
if (isset($_SESSION['username']) && $_SESSION['username'] != "")
$ret = 2; //login, normal user
if ($_SESSION['isAdmin'] == 1)
$ret = 1; //login, admin
}
else if (**isset($_COOKIE['username'])**)
{
if (isset($_COOKIE['username']) && $_COOKIE['username'] != "")
$ret = 2; //login, normal user
if (**$_COOKIE['isAdmin'] == 1**)
**$ret = 1; //login, admin**
}
return $ret;
}
Timeline
- 21 October 2016: Notified about discovery and other vulnerabilities
- 25 October 2016: Communicated technical details
- 13 December 2016: Firmware Release 2.21.126, only fixing the authentication bypass! Not notified by WD :(.