published April 24, 2019
🚨 A default empty password on the 'nobody' account is the key to a sneaky authentication bypass in several Western Digital My Cloud devices! 🔥 Think of your My Cloud device as a hotel with a VIP lounge that should only be accessible to guests with a key. But if the hotel mistakenly left a door wide open with no requirement for a key, anyone could stroll in and start rearranging the furniture! This vulnerability allows an attacker to bypass authentication completely, giving them access to modify the web page source code of your My Cloud device. That means they could potentially change settings, steal data, or even compromise your entire cloud storage without breaking a sweat!
Think of your My Cloud device as a hotel with a VIP lounge that should only be accessible to guests with a key. But if the hotel mistakenly left a door wide open with no requirement for a key, anyone could stroll in and start rearranging the furniture! The issue lies in the login_mgr.cgi file, which checks user credentials against the /etc/shadow file. The 'nobody' account has a default empty password, allowing low-privilege users to access the control panel API without proper authentication.
This vulnerability allows an attacker to bypass authentication completely, giving them access to modify the web page source code of your My Cloud device. That means they could potentially change settings, steal data, or even compromise your entire cloud storage without breaking a sweat! To secure your device, immediately upgrade the firmware to version 2.31.174 or later. Additionally, ensure that no accounts have empty passwords and enforce strong password policies across your My Cloud devices. Regularly review user permissions to avoid unauthorized access. You've got this! By following these steps, you'll lock down your My Cloud devices and keep them secure. 🛡️