CVSS: 8.8EPSS: 0%CPEs: 11EXPL: 0CVE-2022-22993 – Limited Server-Side Request Forgery vulnerability on Western Digital My Cloud devices.
https://notcve.org/view.php?id=CVE-2022-22993
A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the server by bypassing access controls. The vulnerability was addressed by creating a whitelist for valid parameters. Se ha detectado una vulnerabilidad de tipo SSRF limitada en los dispositivos My Cloud de Western Digital que podía permitir a un atacante hacerse pasar por un servidor y llegar a cualquier página del mismo omitiendo los controles de acceso. La vulnerabilidad fue abordada al crear una lista blanca de parámetros válidos This vulnerability allows network-adjacent attackers to escalate privileges on affected installations of Western Digital MyCloud PR4100. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the cgi_api endpoint. • https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117 https://www.zerodayinitiative.com/advisories/ZDI-22-348 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 10.0EPSS: 0%CPEs: 11EXPL: 0CVE-2022-22992 – Command Injection Remote Code Execution vulnerability on Western Digital My Cloud devices.
https://notcve.org/view.php?id=CVE-2022-22992
A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual arguments to shell functions coming from user input. Se ha detectado una vulnerabilidad de ejecución de código remota por inyección de comandos en los dispositivos My Cloud de Western Digital que podría permitir a un atacante ejecutar comandos arbitrarios del sistema en el dispositivo. La vulnerabilidad fue abordada al escapar de los argumentos individuales a las funciones de shell procedentes de la entrada del usuario This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Western Digital MyCloud PR4100. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the cloudAccess endpoint. • https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117 • CWE-116: Improper Encoding or Escaping of Output •
CVSS: 8.8EPSS: 5%CPEs: 11EXPL: 0CVE-2022-22990 – Limited authentication bypass vulnerability on Western Digital My Cloud devices
https://notcve.org/view.php?id=CVE-2022-22990
A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts. Se ha detectado una vulnerabilidad de omisión de autenticación limitada que podría permitir a un atacante lograr una ejecución de código remota y escalar privilegios en los dispositivos My Cloud. Se ha abordado esta vulnerabilidad al cambiar la lógica de comprobación de los tokens de acceso y reescribiendo la lógica de las reglas en los scripts de PHP This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Western Digital MyCloud PR4100. Authentication is not required to exploit this vulnerability. The specific flaw exists within the nasAdmin service, which listens on TCP ports 80 and 443 by default. • https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117 https://www.zerodayinitiative.com/advisories/ZDI-22-076 https://www.zerodayinitiative.com/advisories/ZDI-22-347 • CWE-287: Improper Authentication CWE-697: Incorrect Comparison •
CVSS: 8.8EPSS: 0%CPEs: 11EXPL: 0CVE-2022-22991 – Command injection through unsecured HTTP calls on Western Digital My Cloud devices
https://notcve.org/view.php?id=CVE-2022-22991
A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP call. Addressed this vulnerability by disabling checks for internet connectivity using HTTP. Un usuario malicioso en la misma LAN podría usar una suplantación de DNS seguida de un ataque de inyección de comandos para engañar a un dispositivo NAS para que sea cargado mediante una llamada HTTP no segura. Se ha abordado esta vulnerabilidad al deshabilitar las comprobaciones de conectividad a Internet mediante HTTP This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Western Digital MyCloud PR4100. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ConnectivityService service. • https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117 https://www.zerodayinitiative.com/advisories/ZDI-22-077 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 11EXPL: 0CVE-2022-22989 – Pre-authenticated stack overflow vulnerability on FTP Service
https://notcve.org/view.php?id=CVE-2022-22989
My Cloud OS 5 was vulnerable to a pre-authenticated stack overflow vulnerability on the FTP service that could be exploited by unauthenticated attackers on the network. Addressed the vulnerability by adding defenses against stack overflow issues. Mi Cloud OS 5 era vulnerable a una vulnerabilidad de desbordamiento de pila preautenticada en el servicio FTP. Se abordó la vulnerabilidad añadiendo defensas contra los problemas de desbordamiento de pila • https://www.westerndigital.com/support/product-security/wdc-22002-my-cloud-os5-firmware-5-19-117 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •