Flaw in Western Digital My Cloud exposes the content to hackers

guest · Sep 19, 2018

Flaw in Western Digital My Cloud exposes the content to hackers
September 19, 2018
https://securityaffairs.co/wordpress/76344/hacking/western-digital-my-cloud-flaw-2.html

Researchers at security firm Securify have discovered an elevation of privilege vulnerability in the Western Digital My Cloud platform that could be exploited by attackers to gain admin-level access to the device via an HTTP request.

The flaw, tracked as CVE-2018-17153, would allow an unauthenticated attacker with network access to the device to authenticate as an admin without providing a password.

The vulnerability resides in the process of creation of admin sessions implemented by the My Cloud devices that bound to the user’s IP address.

Once the session is created, it is possible to call the authenticated CGI modules by sending the cookie username=admin in the HTTP request. The CGI will check if a valid session is present and bound to the user’s IP address. [...] “It was found that it is possible for an unauthenticated attacker to create a valid session without requiring to authenticate.”
Click to expand...

guest · Sep 22, 2018

My Cloud OS3 September 2018 Security Hotfix Firmware Download
https://support.wdc.com/knowledgebase/answer.aspx?ID=25952&s

What's new!

Resolved authentication bypass vulnerability (CVE-2018-17153).

Click to expand...

Western Digital
https://twitter.com/westerndigital/status/1043277178689835013

Hi, just a heads up, the recently reported vulnerability in the My Cloud firmware has been addressed with a user-installable hotfix found here: https://support.wdc.com/knowledgebase/answer.aspx?ID=25952&s … This will be included in an over-the-air update as part of the normal upgrade schedule for these product
Click to expand...

Log in or Sign up

Flaw in Western Digital My Cloud exposes the content to hackers

guest Guest

guest Guest

Log in or Sign up

Flaw in Western Digital My Cloud exposes the content to hackers

guest Guest

guest Guest

Useful Searches