rapid7/metasploit-framework — pull request #3199 by phikshun (2014-04-07 21:28:47+00:00)
Title: Add WD MyCloud CSRF Command Injection Exploit Module

This exploit generates a CSRF vulnerability to trigger command injection on the Western Digital MyCloud NAS. The WD MyCloud NAS provides turn key system backup capabilities, including Time Capsule compatibility. See http://www.wdc.com/en/products/products.aspx?id=1140 for details.

The vulnerable URL is:

/api/1.0/rest/language_configuration?language=`injection_here`&format=xml&rest_method=PUT

Since the NAS broadcasts its name via mDNS, UPnP and NETBIOS, the exploit automatically targets wdmycloud (works on Windows) and wdmycloud.local (works on Mac OS). It also allows the user to configure the RHOST variable to target a unique hostname or IP. The exploit itself is simple -- it uses backticks to inject linux commands into a call to the device's language selection URL. Since the device has netcat preinstalled, getting a reverse shell is trivial. As an added bonus, I've added JS based redirect capability.

I can post screen shots if necessary -- I do not have access to the hardware at this moment.