Security researchers at VerSprite have tested and discovered several vulnerabilities in Western Digital's My Cloud NAS (Network Attached Storage) hard drive, which the company markets as your own personal cloud server.
The device, sold worldwide, allows users to place it in their home and access it over a local network, or even over an Internet connection when traveling around the world.
It works in the same way as any other cloud storage system, except that only you know where your server is at all times: in your office, in the living room, and so on.
As researchers at VerSprite now explain, the WD My Cloud device, which runs a version of Debian Linux, allows users to interact with it through two methods: a Web-accessible UI (http://wdmycloud.local/UI/) and a RESTful API (http://wdmycloud.local/api/).
By examining these entry points into the system, the researchers were able to find two significant vulnerabilities: a command injection issue and a cross-site request forgery (“CSRF”) vulnerability.
The former can only be exploited by users with authorized access to the device, by “uploading” large files over 2GB, which are given malicious names.
Because the My Cloud’s API does not fix these file names, attackers can enter various commands, and easily give themselves root access to the device.
In case the attacker does not have physical access to the device, the VerSprite researchers again detailed a variant that can lead to exploitation, in which the attacker places their 2GB file with the malicious name in the device’s “Public” folder, which is created by default and is available on the local network for all devices with network or Internet access enabled.
Whenever an authorized user goes to this Public folder using the Windows, Linux, or Mac My Cloud app, the command in the file name would be executed contrary to the device’s API and with the user’s privileges. The file name could in these cases contain instructions to create a new root-level user for the attacker.
The second vulnerability found by the VerSprite researchers was in the device’s Web application, which “does not distinguish between genuine and fake HTTP requests,” facilitating basic CSRF attacks.
This vulnerability is a bit more difficult to exploit since Internet access must be enabled, as well as access to a valid session cookie and information about the hostname or IP address of the WD My Cloud.
The researchers say that, by using social engineering tricks and WebRTC, the chances of this vulnerability being exploited can be improved and allow hackers to perform a reverse shell attack.
VerSprite confirms that firmware versions 04.01.03-421 and 04.01.04-422 are vulnerable, and Western Digital staff is already preparing patches to be deployed within the next few days.
