Rapid7 Vulnerability & Exploit Database

Western Digital MyCloud unauthenticated command injection

Back to Search

Western Digital MyCloud unauthenticated command injection

Disclosed
12/14/2016
Created
07/28/2023

Description

This module exploits authentication bypass (CVE-2018-17153) and command injection (CVE-2016-10108) vulnerabilities in Western Digital MyCloud before 2.30.196 in order to achieve unauthenticated remote code execution as the root user. The module first performs a check to see if the target is WD MyCloud. If so, it attempts to trigger an authentication bypass (CVE-2018-17153) via a crafted GET request to /cgi-bin/network_mgr.cgi. If the server responds as expected, the module assesses the vulnerability status by attempting to exploit a commend injection vulnerability (CVE-2016-10108) in order to print a random string via the echo command. This is done via a crafted POST request to /web/google_analytics.php. If the server is vulnerable, the same command injection vector is leveraged to execute the payload. This module has been successfully tested against Western Digital MyCloud version 2.30.183. Note: based on the available disclosures, it seems that the command injection vector (CVE-2016-10108) might be exploitable without the authentication bypass (CVE-2018-17153) on versions before 2.21.126. The obtained results on 2.30.183 imply that the patch for CVE-2016-10108 did not actually remove the command injection vector, but only prevented unauthenticated access to it.

Author(s)

  • Erik Wynter
  • Steven Campbell
  • Remco Vermeulen

Platform

Linux,Unix

Architectures

armle, cmd

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/linux/http/wd_mycloud_unauthenticated_cmd_injection
msf exploit(wd_mycloud_unauthenticated_cmd_injection) > show targets
    ...targets...
msf exploit(wd_mycloud_unauthenticated_cmd_injection) > set TARGET < target-id >
msf exploit(wd_mycloud_unauthenticated_cmd_injection) > show options
    ...show and set options...
msf exploit(wd_mycloud_unauthenticated_cmd_injection) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;