漏洞描述

Western Digital My Cloud Mirror Gen2等都是美国西部数据（Western Digital）公司的产品。Western Digital My Cloud Mirror Gen2是一款个人云存储设备。Western Digital My Cloud EX2 Ultra是一款个人云存储设备。Western Digital My Cloud EX2100是一款个人存储设备。 多款Western Digital产品中存在安全漏洞，该漏洞源于程序没有过滤传递到cgi_unzip命令的‘name’参数。攻击者可利用该漏洞执行代码。以下产品及版本受到影响：使用2.31.183之前版本固件的Western Digital My Cloud Cloud Mirror Gen2；使用2.31.183之前版本固件的My Cloud Cloud EX2 Ultra；使用2.31.183之前版本固件的My Cloud Cloud EX2100；使用2.31.183之前版本固件的My Cloud Cloud EX4100；使用2.31.183之前版本固件的My Cloud Cloud DL2100；使用2.31.183之前版本固件的My Cloud Cloud DL4100；使用2.31.183之前版本固件的My Cloud Cloud PR2100；使用2.31.183之前版本固件的My Cloud Cloud PR4100。

Western Digital My Cloud Cloud, Mirror Gen2, EX2 Ultra, EX2100, EX4100, DL2100, DL4100, PR2100 and PR4100 before firmware 2.31.183 are affected by a code execution (as root, starting from a low-privilege user session) vulnerability. The cgi-bin/webfile_mgr.cgi file allows arbitrary file write by abusing symlinks. Specifically, this occurs by uploading a tar archive that contains a symbolic link, then uploading another archive that writes a file to the link using the "cgi_untar" command. Other commands might also be susceptible. Code can be executed because the "name" parameter passed to the cgi_unzip command is not sanitized.