Exploit-DB #43435
Description: WDMyCloud < 2.30.165 - Multiple Vulnerabilities
Type: remote
Platform: hardware
Date: 2018-01-03
Author: GulfTech Security

Exploit:
WDMyCloud Multiple Vulnerabilities
Vendor: Western Digital
Product: WDMyCloud
Version: <= 2.30.165
Website: https://www.wdc.com/products/network-attached-storage.html


###########################################################################
                     ______      ____________          __  
                    / ____/_  __/ / __/_  __/__  _____/ /_ 
                   / / __/ / / / / /_  / / / _ \/ ___/ __ \
                  / /_/ / /_/ / / __/ / / /  __/ /__/ / / /         
                  \____/\__,_/_/_/   /_/  \___/\___/_/ /_/ 
                                                                
                     GulfTech Research and Development                                                                 

###########################################################################
#             WDMyCloud <= 2.30.165 Multiple Vulnerabilities              #
###########################################################################

Released Date: 2018-01-04
Last Modified: 2017-06-11
 Company Info: Western Digital
 Version Info: 
              Vulnerable
               MyCloud <= 2.30.165
               MyCloudMirror <= 2.30.165
               My Cloud Gen 2
               My Cloud PR2100
               My Cloud PR4100
               My Cloud EX2 Ultra
               My Cloud EX2
               My Cloud EX4
               My Cloud EX2100
               My Cloud EX4100
               My Cloud DL2100
               My Cloud DL4100

              Not Vulnerable
               MyCloud 04.X Series
 

--[ Table of contents

00 - Introduction
    00.1 Background

01 - Unrestricted file upload
    01.1 - Vulnerable code analysis
    01.2 - Remote exploitation

02 - Hard coded backdoor
    02.1 - Vulnerable code analysis
    02.2 - Remote exploitation

03 - Miscellaneous security issues
    03.1 - Cross site request forgery
    03.2 - Command injection
    03.3 - Denial of service
    03.4 - Information disclosure

04 - Reused Code

05 - Credit

06 - Proof of concept

07 - Disclosure timeline

08 - Solution

09 - Contact information

10 - References


--[ 00 - Introduction

The purpose of this article is to detail the research that I have completed 
regarding the Western Digital MyCloud family of devices.

Several serious security issues were uncovered during my research. 
Vulnerabilities such as pre auth remote root code execution, as well as a 
hardcoded backdoor admin account which can NOT be changed. The backdoor 
also allows for pre auth remote root code execution on the affected device.

The research was conducted on both a WDMyCloud 4TB and a WDMyCloudMirror
16TB with the latest available firmware 2.30.165. My research shows that
the 04 branch of the WDMyCloud firmware is not vulnerable to these issues.

--[ 00.1 - Background

WD My Cloud is a personal cloud storage unit to organize your photos and 
videos. It is currently the best selling NAS (network attached storage)
device listed on the amazon.com website, and is used by individuals and
businesses alike.  It's purpose is to host your files, and it also has the
ability to sync them with various cloud and web based services.


--[ 01 - Unrestricted file upload

The WDMyCloud device is vulnerable to an unrestricted file upload 
vulnerability within the following file:

/usr/local/modules/web/pages/jquery/uploader/multi_uploadify.php

The root of the problem here is due to the misuse and misunderstanding of
the PHP gethostbyaddr() function used within PHP, by the developer of this 
particular piece of code. From the PHP manual this functions return values 
are defined as the following for gethostbyaddr():

"Returns the host name on success, the unmodified ip_address on failure, or 
FALSE on malformed input."

With a brief overview of the problem, let's have a look at the offending 
code in order to get a better understanding of what is going on with this 
particular vulnerability.

--[ 01.1 - Vulnerable code analysis

Below is the code from the vulnerable "multi_uploadify.php" script. You can
see that I have annoted the code to explain what is happening.

#BUG 01: Here the attacker controlled "Host" header is used to define the 
remote auth server. This is by itself really bad, as an attacker could
easily just specify that the host be the IP address of a server that they
are in control of. But, if we send it an invalid "Host" header it will just
simply return FALSE as defined in the PHP manual.

$ip = gethostbyaddr($_SERVER['HTTP_HOST']);
$name = $_REQUEST['name'];
$pwd = $_REQUEST['pwd'];
$redirect_uri =  $_REQUEST['redirect_uri']; 

//echo $name ."
".$pwd."
".$ip;

#BUG 02: At this point, this request should always fail. The $result
variable should now be set to FALSE.

$result = @stripslashes( @join( @file( "http://".$ip."/mydlink/mydlink.cgi?
cmd=1&name=".$name."=&pwd=".$pwd ),"" ));

#BUG 03: Here an empty haystack is searched, and thus strstr() returns a
value of FALSE.

$result_1 = strstr($result,"0");
$result_1 = substr ($result_1, 0,28);  

#BUG 04: The strncmp() call here is a strange one. It looks for a specific
login failure. So, it never accounts for when things go wrong or slightly
unexpected. As a result this "if" statement will always be skipped.

if (strncmp ($result_1,"0",28) == 0 )
//if (strstr($result,"0")== 0 )
{
    header("HTTP/1.1 302 Found");
  header("Location: ".$redirect_uri."?status=0");
  exit();   
}

#BUG 05: At this point all checks have been passed, and an attacker can use
this issue to upload any file to the server that they want.

The rest of the source code was omitted for the sake of breivity, but it 
just handles the file upload logic once the user passes the authentication
checks.

--[ 01.2 - Remote exploitation

Exploiting this issue to gain a remote shell as root is a rather trivial
process. All an attacker