SEC Consult SA-20120618-0 :: Western Digital ShareSpace WEB GUI Sensitive Data Disclosure Jun 18 2012 01:38PM
SEC Consult Vulnerability Lab (research sec-consult com)
SEC Consult Vulnerability Lab Security Advisory < 20120618-0 >
title: WD ShareSpace WEB GUI Sensitive Data Disclosure
product: WD ShareSpace network storage system
vulnerable version: WD ShareSpace <= v2.3.02 (D and E series)
fixed version: none
impact: High
homepage: http://support.wdc.com/product/download.asp?groupid=901&sid=107&lang=en
found: 2012-01-31
by: V. Paulikas
SEC Consult Vulnerability Lab

Vendor description:
WD ShareSpace is high-speed network-attached storage system with capacities up
to 8 TB and a space-saving footprint gives you all the benefits of a big time
data center without the need for a big time IT department. Perfect for
centralizing and sharing data and multimedia files on a small office or home

Source: http://www.wdc.com/wdproducts/library/AAG/ENG/4178-705023.pdf

Vulnerability overview/description:
WD ShareSpace network storage system has a built-in WEB GUI that is used to
administer the ShareSpace device. The built-in WEB GUI is prone to a sensitive
data disclosure due to an improper configuration of access rights of the
configuration file config.xml. By directly accessing the config.xml file
without authentication it is possible to obtain system's configuration data,
which includes network settings, shared folder names, SMB users and hashed
passwords, administrator's credentials, etc.

Proof of concept:
The vulnerability is exploited by accessing the config.xml file directly with
a browser.

PoC URL has been removed as no vendor patch is available.

Vulnerable / tested versions:
WD ShareSpace v2.3.01

Vendor contact timeline:
2012-02-17: Contacting vendor through help center
2012-02-24: Vendor response, issue is being forwarded to the appropriate
product development team (Level 2 team as by WD) for review and
confirmation. Case 120217-002268 opened.
2012-03-02: Vendor response, issue has been reviewed, additional information
2012-03-07: Providing additional information regarding the vulnerability.
2012-03-12: Vendor response, vulnerability escalated to their engineering team
to verify and fix if possible.
2012-04-19: Asking if the vulnerability was fixed because of long response
2012-04-24: Vendor response, vulnerability not resolved.
2012-05-03: Vendor response, firmware update available, not related to
2012-05-07: Asking vendor to recheck if firmware update really
solves the problem.
2012-05-09: Vendor confirms, that the new firmware does not solve the problem.
2012-05-10: Asking vendor for more indepth research of the issue
2012-05-15: Vendor confirms the issue: ShareSpace running firmware version
2.3.02 (D and E series) is affected.
Vendor disagrees that it's a security vulnerability.
2012-05-31: Informing vendor about the release of the advisory on 2012-06-18.
No answer.
2012-06-11: Informing vendor once more about the release of advisory on
2012-06-18. No answer.
2012-06-18: No further response from vendor. Advisory published according to
the SEC Consult's responsible disclosure policy.

No patch available.

Allow access to the administrative interface only from trusted networks.

Advisory URL:

SEC Consult Unternehmensberatung GmbH

Office Vienna
Mooslackengasse 17
A-1190 Vienna

Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 25
Mail: research at sec-consult dot com

EOF V. Paulikas / @2012

[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus