CVE-2023-22819

Uncontrolled resource consumption vulnerability in Western Digital My Cloud, My Cloud Home and SanDisk ibi products

Severity Score

4.9

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount of memory, eventually resulting in the service being stopped and restarted was discovered in Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi and Western Digital My Cloud OS 5 devices. This issue requires the attacker to already have root privileges in order to exploit this vulnerability. This issue affects My Cloud Home and My Cloud Home Duo: before 9.5.1-104; ibi: before 9.5.1-104; My Cloud OS 5: before 5.27.161.

Se descubrió un problema de vulnerabilidad de consumo de recursos no controlado que podría surgir al enviar solicitudes manipuladas a un servicio para consumir una gran cantidad de memoria, lo que eventualmente resultaría en que el servicio se detuviera y reiniciara en los dispositivos Western Digital My Cloud Home, My Cloud Home Duo, SanDisk ibi y Western Digital My Cloud OS 5. Este problema requiere que el atacante ya tenga privilegios de root para explotar esta vulnerabilidad. Este problema afecta a My Cloud Home y My Cloud Home Duo: antes de la versión 9.5.1-104; ibi: antes de la versión 9.5.1-104; My Cloud OS 5: antes de la versión 5.27.161.

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Western Digital MyCloud PR4100 NAS devices. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the RESTSDK server. The issue results from uncontrolled resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition on the device.

*Credits: Sam Thomas (@_s_n_t) of Pentest Ltd (@pentestltd) working with Trend Micro’s Zero Day Initiative

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2023-01-06 CVE Reserved
2024-02-05 CVE Published
2024-02-14 EPSS Updated
2024-09-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-400: Uncontrolled Resource Consumption
CWE-770: Allocation of Resources Without Limits or Throttling

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://www.westerndigital.com/support/product-security/wdc-24001-western-digital-my-cloud-os-5-my-cloud-home-duo-and-sandisk-ibi-firmware-update	2024-02-13

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Westerndigital Search vendor "Westerndigital"	My Cloud Pr4100 Firmware Search vendor "Westerndigital" for product "My Cloud Pr4100 Firmware"	< 5.27.161 Search vendor "Westerndigital" for product "My Cloud Pr4100 Firmware" and version " < 5.27.161"	-	Affected	in	Westerndigital Search vendor "Westerndigital"	My Cloud Pr4100 Search vendor "Westerndigital" for product "My Cloud Pr4100"	-	-	Safe
Westerndigital Search vendor "Westerndigital"	My Cloud Ex4100 Firmware Search vendor "Westerndigital" for product "My Cloud Ex4100 Firmware"	< 5.27.161 Search vendor "Westerndigital" for product "My Cloud Ex4100 Firmware" and version " < 5.27.161"	-	Affected	in	Westerndigital Search vendor "Westerndigital"	My Cloud Ex4100 Search vendor "Westerndigital" for product "My Cloud Ex4100"	-	-	Safe
Westerndigital Search vendor "Westerndigital"	My Cloud Ex2 Ultra Firmware Search vendor "Westerndigital" for product "My Cloud Ex2 Ultra Firmware"	< 5.27.161 Search vendor "Westerndigital" for product "My Cloud Ex2 Ultra Firmware" and version " < 5.27.161"	-	Affected	in	Westerndigital Search vendor "Westerndigital"	My Cloud Ex2 Ultra Search vendor "Westerndigital" for product "My Cloud Ex2 Ultra"	-	-	Safe
Westerndigital Search vendor "Westerndigital"	My Cloud Mirror G2 Firmware Search vendor "Westerndigital" for product "My Cloud Mirror G2 Firmware"	< 5.27.161 Search vendor "Westerndigital" for product "My Cloud Mirror G2 Firmware" and version " < 5.27.161"	-	Affected	in	Westerndigital Search vendor "Westerndigital"	My Cloud Mirror G2 Search vendor "Westerndigital" for product "My Cloud Mirror G2"	-	-	Safe
Westerndigital Search vendor "Westerndigital"	My Cloud Dl2100 Firmware Search vendor "Westerndigital" for product "My Cloud Dl2100 Firmware"	< 5.27.161 Search vendor "Westerndigital" for product "My Cloud Dl2100 Firmware" and version " < 5.27.161"	-	Affected	in	Westerndigital Search vendor "Westerndigital"	My Cloud Dl2100 Search vendor "Westerndigital" for product "My Cloud Dl2100"	-	-	Safe
Westerndigital Search vendor "Westerndigital"	My Cloud Dl4100 Firmware Search vendor "Westerndigital" for product "My Cloud Dl4100 Firmware"	< 5.27.161 Search vendor "Westerndigital" for product "My Cloud Dl4100 Firmware" and version " < 5.27.161"	-	Affected	in	Westerndigital Search vendor "Westerndigital"	My Cloud Dl4100 Search vendor "Westerndigital" for product "My Cloud Dl4100"	-	-	Safe
Westerndigital Search vendor "Westerndigital"	My Cloud Ex2100 Firmware Search vendor "Westerndigital" for product "My Cloud Ex2100 Firmware"	< 5.27.161 Search vendor "Westerndigital" for product "My Cloud Ex2100 Firmware" and version " < 5.27.161"	-	Affected	in	Westerndigital Search vendor "Westerndigital"	My Cloud Ex2100 Search vendor "Westerndigital" for product "My Cloud Ex2100"	-	-	Safe
Westerndigital Search vendor "Westerndigital"	My Cloud Glacier Firmware Search vendor "Westerndigital" for product "My Cloud Glacier Firmware"	< 5.27.161 Search vendor "Westerndigital" for product "My Cloud Glacier Firmware" and version " < 5.27.161"	-	Affected	in	Westerndigital Search vendor "Westerndigital"	My Cloud Glacier Search vendor "Westerndigital" for product "My Cloud Glacier"	-	-	Safe
Westerndigital Search vendor "Westerndigital"	Wd Cloud Firmware Search vendor "Westerndigital" for product "Wd Cloud Firmware"	< 5.27.161 Search vendor "Westerndigital" for product "Wd Cloud Firmware" and version " < 5.27.161"	-	Affected	in	Westerndigital Search vendor "Westerndigital"	Wd Cloud Search vendor "Westerndigital" for product "Wd Cloud"	-	-	Safe
Westerndigital Search vendor "Westerndigital"	My Cloud Home Firmware Search vendor "Westerndigital" for product "My Cloud Home Firmware"	< 9.5.1-104 Search vendor "Westerndigital" for product "My Cloud Home Firmware" and version " < 9.5.1-104"	-	Affected	in	Westerndigital Search vendor "Westerndigital"	My Cloud Home Search vendor "Westerndigital" for product "My Cloud Home"	-	-	Safe
Westerndigital Search vendor "Westerndigital"	My Cloud Home Duo Firmware Search vendor "Westerndigital" for product "My Cloud Home Duo Firmware"	< 9.5.1-104 Search vendor "Westerndigital" for product "My Cloud Home Duo Firmware" and version " < 9.5.1-104"	-	Affected	in	Westerndigital Search vendor "Westerndigital"	My Cloud Home Duo Search vendor "Westerndigital" for product "My Cloud Home Duo"	-	-	Safe
Westerndigital Search vendor "Westerndigital"	Sandisk Ibi Firmware Search vendor "Westerndigital" for product "Sandisk Ibi Firmware"	< 9.5.1-104 Search vendor "Westerndigital" for product "Sandisk Ibi Firmware" and version " < 9.5.1-104"	-	Affected	in	Westerndigital Search vendor "Westerndigital"	Sandisk Ibi Search vendor "Westerndigital" for product "Sandisk Ibi"	-	-	Safe