Headline
CVE-2023-22813: WDC-23004 Western Digital My Cloud OS 5, My Cloud Home, SanDisk ibi and WD Cloud Mobile and Web App Update | Western Digital
A device API endpoint was missing access controls on Western Digital My Cloud OS 5 Mobile App on Android, iOS, Western Digital My Cloud Home Mobile App on iOS, Android, SanDIsk ibi Mobile App on Android, iOS, Western Digital WD Cloud Mobile App on Android, iOS, Western Digital My Cloud OS 5 Web App, Western Digital My Cloud Home Web App, SanDisk ibi Web App and the Western Digital WD Web App. Due to a permissive CORS policy and missing authentication requirement for private IPs, a remote attacker on the same network as the device could obtain device information by convincing a victim user to visit an attacker-controlled server and issue a cross-site request.This issue affects My Cloud OS 5 Mobile App: through 4.21.0; My Cloud Home Mobile App: through 4.21.0; ibi Mobile App: through 4.21.0; WD Cloud Mobile App: through 4.21.0; My Cloud OS 5 Web App: through 4.26.0-6126; My Cloud Home Web App: through 4.26.0-6126; ibi Web App: through 4.26.0-6126; WD Web App: through 4.26.0-6126.
WDC Tracking Number: WDC-23004
Product Line: My Cloud, My Cloud Home, My Cloud Home Duo, SanDisk ibi, and WD Cloud
Published: March 5, 2023
Last Updated: March 24, 2023
Description
Western Digital My Cloud, My Cloud Home, SanDisk ibi and WD Cloud mobile and web apps have been updated to help improve the security of your devices and data.
Product Impact
Minimum Fix Version
Last Updated
ibi App - Android
4.21.0 or later
March 01, 2023
ibi App - iOS
4.21.0 or later
March 01, 2023
My Cloud Home App - Android
4.21.0 or later
March 01, 2023
My Cloud Home App - iOS
4.21.0 or later
March 01, 2023
My Cloud OS 5 App - Android
4.21.0 or later
March 01, 2023
My Cloud OS 5 App - iOS
4.21.0 or later
March 01, 2023
WD Cloud App - Android
4.21.0 or later
March 01, 2023
WD Cloud App - iOS
4.21.0 or later
March 01, 2023
ibi Web App
4.26.0-6126
March 08, 2023
My Cloud Home Web App
4.26.0-6126
March 08, 2023
My Cloud Web App
4.26.0-6126
March 08, 2023
WD Cloud Web App
4.26.0-6126
March 08, 2023
Users of the mobile apps should promptly update the apps to reflect the latest changes. The web apps have automatically been updated.
Advisory Summary
Addressed a security concern where a device API endpoint was missing access controls. Due to a permissive CORS policy and missing authentication requirement for private IPs, a remote attacker could obtain device information by convincing a victim user to visit an attacker-controlled server and issue a cross-site request. This was addressed by enforcing token-based authentication on the corresponding endpoint to avoid unauthorized information disclosures.
CVE Number: CVE-2023-22813