Western Digital My Cloud PR4100 prior 2.31.174 File Upload uploadify.php unrestricted upload
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
8.2 | $0-$5k | 0.00 |
A vulnerability was found in Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 (Cloud Software). It has been rated as critical. This issue affects some unknown functionality of the file web/jquery/uploader/uploadify.php of the component File Upload. The manipulation with an unknown input leads to a unrestricted upload vulnerability. Using CWE to declare the problem leads to CWE-434. The product allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. Impacted is confidentiality, integrity, and availability. The summary by CVE is:
Western Digital My Cloud, My Cloud Mirror Gen2, My Cloud EX2 Ultra, My Cloud EX2100, My Cloud EX4100, My Cloud DL2100, My Cloud DL4100, My Cloud PR2100 and My Cloud PR4100 firmware before 2.31.174 is affected by an unauthenticated file upload vulnerability. The page web/jquery/uploader/uploadify.php can be accessed without any credentials, and allows uploading arbitrary files to any location on the attached storage.
The bug was discovered 03/27/2019. The weakness was published 04/24/2019 (Website). The advisory is shared at community.wd.com. The identification of this vulnerability is CVE-2019-9951 since 03/23/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1608.002 for this issue.
The vulnerability was handled as a non-public zero-day exploit for at least 28 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:web/jquery/uploader/uploadify.php it is possible to find vulnerable targets with Google Hacking.
Upgrading to version 2.31.174 eliminates this vulnerability.
Similar entry is available at 134044.
Product
Type
Vendor
Name
- My Cloud
- My Cloud DL2100
- My Cloud DL4100
- My Cloud EX2 Ultra
- My Cloud EX2100
- My Cloud EX4100
- My Cloud Mirror Gen2
- My Cloud PR2100
- My Cloud PR4100
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 8.5VulDB Meta Temp Score: 8.4
VulDB Base Score: 7.3
VulDB Temp Score: 7.0
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 9.8
NVD Vector: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Unrestricted uploadCWE: CWE-434 / CWE-284 / CWE-266
ATT&CK: T1608.002
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
Google Hack: 🔍
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: My Cloud/My Cloud Mirror Gen2/My Cloud EX2 Ultra/My Cloud EX2100/My Cloud EX4100/My Cloud DL2100/My Cloud DL4100/My Cloud PR2100/My Cloud PR4100 2.31.174
Timeline
03/23/2019 🔍03/27/2019 🔍
04/24/2019 🔍
04/25/2019 🔍
06/02/2020 🔍
Sources
Advisory: community.wd.comStatus: Not defined
Confirmation: 🔍
CVE: CVE-2019-9951 (🔍)
See also: 🔍
Entry
Created: 04/25/2019 09:06Updated: 06/02/2020 09:29
Changes: 04/25/2019 09:06 (59), 06/02/2020 09:29 (2)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.