CVE-2023-22817
Server-side Request Forgery vulnerability in Western Digital My Cloud, My Cloud Home and SanDisk ibi products
Severity Score
5.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track
*SSVC
Descriptions
Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS address to point back to the loopback adapter. This could then allow the URL to exploit other vulnerabilities on the local server. This was addressed by fixing DNS addresses that refer to loopback. This issue affects My Cloud OS 5 devices before 5.27.161, My Cloud Home, My Cloud Home Duo and SanDisk ibi devices before 9.5.1-104.
Vulnerabilidad de server-side request forgery (SSRF) que podría permitir que un servidor no autorizado en la red local modifique su URL utilizando otra dirección DNS para apuntar al adaptador de loopback. Esto podría permitir que la URL aproveche otras vulnerabilidades en el servidor local. Esto se solucionó corrigiendo las direcciones DNS que hacen referencia al loopback. Este problema afecta a los dispositivos My Cloud OS 5 anteriores a 5.27.161, My Cloud Home, My Cloud Home Duo y SanDisk ibi anteriores a 9.5.1-104.
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Western Digital MyCloud PR4100 NAS devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the RESTSDK server. The issue results from the lack of proper validation of a URI prior to accessing resources. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.
*Credits:
Sam Thomas (@_s_n_t) of Pentest Ltd (@pentestltd) working with Trend Micro’s Zero Day Initiative
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-01-06 CVE Reserved
- 2024-02-05 CVE Published
- 2024-02-14 EPSS Updated
- 2024-08-02 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-918: Server-Side Request Forgery (SSRF)
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Westerndigital Search vendor "Westerndigital" | My Cloud Pr2100 Firmware Search vendor "Westerndigital" for product "My Cloud Pr2100 Firmware" | < 5.27.161 Search vendor "Westerndigital" for product "My Cloud Pr2100 Firmware" and version " < 5.27.161" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Pr2100 Search vendor "Westerndigital" for product "My Cloud Pr2100" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Pr4100 Firmware Search vendor "Westerndigital" for product "My Cloud Pr4100 Firmware" | < 5.27.161 Search vendor "Westerndigital" for product "My Cloud Pr4100 Firmware" and version " < 5.27.161" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Pr4100 Search vendor "Westerndigital" for product "My Cloud Pr4100" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Ex4100 Firmware Search vendor "Westerndigital" for product "My Cloud Ex4100 Firmware" | < 5.27.161 Search vendor "Westerndigital" for product "My Cloud Ex4100 Firmware" and version " < 5.27.161" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Ex4100 Search vendor "Westerndigital" for product "My Cloud Ex4100" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Ex2 Ultra Firmware Search vendor "Westerndigital" for product "My Cloud Ex2 Ultra Firmware" | < 5.27.161 Search vendor "Westerndigital" for product "My Cloud Ex2 Ultra Firmware" and version " < 5.27.161" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Ex2 Ultra Search vendor "Westerndigital" for product "My Cloud Ex2 Ultra" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Mirror G2 Firmware Search vendor "Westerndigital" for product "My Cloud Mirror G2 Firmware" | < 5.27.161 Search vendor "Westerndigital" for product "My Cloud Mirror G2 Firmware" and version " < 5.27.161" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Mirror G2 Search vendor "Westerndigital" for product "My Cloud Mirror G2" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Dl2100 Firmware Search vendor "Westerndigital" for product "My Cloud Dl2100 Firmware" | < 5.27.161 Search vendor "Westerndigital" for product "My Cloud Dl2100 Firmware" and version " < 5.27.161" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Dl2100 Search vendor "Westerndigital" for product "My Cloud Dl2100" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Dl4100 Firmware Search vendor "Westerndigital" for product "My Cloud Dl4100 Firmware" | < 5.27.161 Search vendor "Westerndigital" for product "My Cloud Dl4100 Firmware" and version " < 5.27.161" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Dl4100 Search vendor "Westerndigital" for product "My Cloud Dl4100" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Ex2100 Firmware Search vendor "Westerndigital" for product "My Cloud Ex2100 Firmware" | < 5.27.161 Search vendor "Westerndigital" for product "My Cloud Ex2100 Firmware" and version " < 5.27.161" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Ex2100 Search vendor "Westerndigital" for product "My Cloud Ex2100" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Glacier Firmware Search vendor "Westerndigital" for product "My Cloud Glacier Firmware" | < 5.27.161 Search vendor "Westerndigital" for product "My Cloud Glacier Firmware" and version " < 5.27.161" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Glacier Search vendor "Westerndigital" for product "My Cloud Glacier" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | Wd Cloud Firmware Search vendor "Westerndigital" for product "Wd Cloud Firmware" | < 5.27.161 Search vendor "Westerndigital" for product "Wd Cloud Firmware" and version " < 5.27.161" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | Wd Cloud Search vendor "Westerndigital" for product "Wd Cloud" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Home Firmware Search vendor "Westerndigital" for product "My Cloud Home Firmware" | < 9.5.1-104 Search vendor "Westerndigital" for product "My Cloud Home Firmware" and version " < 9.5.1-104" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Home Search vendor "Westerndigital" for product "My Cloud Home" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | My Cloud Home Duo Firmware Search vendor "Westerndigital" for product "My Cloud Home Duo Firmware" | < 9.5.1-104 Search vendor "Westerndigital" for product "My Cloud Home Duo Firmware" and version " < 9.5.1-104" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | My Cloud Home Duo Search vendor "Westerndigital" for product "My Cloud Home Duo" | - | - |
Safe
|
| Westerndigital Search vendor "Westerndigital" | Sandisk Ibi Firmware Search vendor "Westerndigital" for product "Sandisk Ibi Firmware" | < 9.5.1-104 Search vendor "Westerndigital" for product "Sandisk Ibi Firmware" and version " < 9.5.1-104" | - |
Affected
| in | Westerndigital Search vendor "Westerndigital" | Sandisk Ibi Search vendor "Westerndigital" for product "Sandisk Ibi" | - | - |
Safe
|