Western Digital PR4100 up to 2.31 cgi-bin/webfile_mgr.cgi Name link following

Summaryinfo

A vulnerability has been found in Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 up to 2.31 and classified as critical. The impacted element is an unknown function of the file cgi-bin/webfile_mgr.cgi. This manipulation of the argument Name as part of Parameter causes link following. The identification of this vulnerability is CVE-2019-9949. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 up to 2.31 (Cloud Software). It has been declared as critical. Affected by this vulnerability is an unknown part of the file cgi-bin/webfile_mgr.cgi. The manipulation of the argument name as part of a Parameter leads to a link following vulnerability. The CWE definition for the vulnerability is CWE-59. The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code execution (as root, starting from a low-privilege user session) vulnerability. The cgi-bin/webfile_mgr.cgi file allows arbitrary file write by abusing symlinks. Specifically, this occurs by uploading a tar archive that contains a symbolic link, then uploading another archive that writes a file to the link using the "cgi_untar" command. Other commands might also be susceptible. Code can be executed because the "name" parameter passed to the cgi_unzip command is not sanitized.

The weakness was shared 05/23/2019 (Website). It is possible to read the advisory at community.wd.com. This vulnerability is known as CVE-2019-9949 since 03/23/2019. The exploitation appears to be easy. The attack can be launched remotely. A single authentication is necessary for exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2.31.183 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Western Digital

Name

• DL2100
• DL4100
• EX2 Ultra
• EX2100
• EX4100
• Mirror Gen2
• My Cloud Cloud
• PR2100
• PR4100

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17
• 2.18
• 2.19
• 2.20
• 2.21
• 2.22
• 2.23
• 2.24
• 2.25
• 2.26
• 2.27
• 2.28
• 2.29
• 2.30
• 2.31

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion