CVE-2019-9949: westerndigital my_cloud_firmware Link Following

Vulnerability summary

CVE-2019-9949 is a high (CVSS 9.0) Link Following vulnerability in westerndigital my_cloud_firmware. EPSS estimates a 3.00% chance of exploitation in the next 30 days, higher than 87.1% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 23-05-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code execution (as root, starting from a low-privilege user session) vulnerability. The cgi-bin/webfile_mgr.cgi file allows arbitrary file write by abusing symlinks. Specifically, this occurs by uploading a tar archive that contains a symbolic link, then uploading another archive that writes a file to the link using the "cgi_untar" command. Other commands might also be susceptible. Code can be executed because the "name" parameter passed to the cgi_unzip command is not sanitized.

• CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.