SEC Consult SA-20120618-0 :: Western Digital ShareSpace WEB GUI- Sensitive Data Disclosure

From: SEC Consult Vulnerability Lab <>
To: bugtraq <>,
Subject: SEC Consult SA-20120618-0 :: Western Digital ShareSpace WEB GUI- Sensitive Data Disclosure

SEC Consult Vulnerability Lab Security Advisory < 20120618-0 >
              title: WD ShareSpace WEB GUI Sensitive Data Disclosure
            product: WD ShareSpace network storage system
 vulnerable version: WD ShareSpace <= v2.3.02 (D and E series)
      fixed version: none
             impact: High
              found: 2012-01-31
              by: V. Paulikas 
                     SEC Consult Vulnerability Lab 

Vendor description:
WD ShareSpace is high-speed network-attached storage system with capacities up
to 8 TB and a space-saving footprint gives you all the benefits of a big time
data center without the need for a big time IT department. Perfect for
centralizing and sharing data and multimedia files on a small office or home


Vulnerability overview/description:
WD ShareSpace network storage system has a built-in WEB GUI that is used to
administer the ShareSpace device. The built-in WEB GUI is prone to a sensitive
data disclosure due to an improper configuration of access rights of the
configuration file config.xml. By directly accessing the config.xml file
without authentication it is possible to obtain system's configuration data,
which includes network settings, shared folder names, SMB users and hashed
passwords, administrator's credentials, etc.

Proof of concept:
The vulnerability is exploited by accessing the config.xml file directly with
a browser.

PoC URL has been removed as no vendor patch is available.

Vulnerable / tested versions:
WD ShareSpace v2.3.01

Vendor contact timeline:
2012-02-17: Contacting vendor through help center
2012-02-24: Vendor response, issue is being forwarded to the appropriate
            product development team (Level 2 team as by WD) for review and
            confirmation. Case 120217-002268 opened.
2012-03-02: Vendor response, issue has been reviewed, additional information
2012-03-07: Providing additional information regarding the vulnerability.
2012-03-12: Vendor response, vulnerability escalated to their engineering team
            to verify and fix if possible.
2012-04-19: Asking if the vulnerability was fixed because of long response
2012-04-24: Vendor response, vulnerability not resolved.
2012-05-03: Vendor response, firmware update available, not related to
2012-05-07: Asking vendor to recheck if firmware update really
           solves the problem.
2012-05-09: Vendor confirms, that the new firmware does not solve the problem.
2012-05-10: Asking vendor for more indepth research of the issue
2012-05-15: Vendor confirms the issue: ShareSpace running firmware version
            2.3.02 (D and E series) is affected.
            Vendor disagrees that it's a security vulnerability.
2012-05-31: Informing vendor about the release of the advisory on 2012-06-18.
            No answer.
2012-06-11: Informing vendor once more about the release of advisory on
         2012-06-18. No answer.
2012-06-18: No further response from vendor. Advisory published according to
            the SEC Consult's responsible disclosure policy.

No patch available.

Allow access to the administrative interface only from trusted networks.

Advisory URL:

SEC Consult Unternehmensberatung GmbH

Office Vienna
Mooslackengasse 17
A-1190 Vienna

Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 25
Mail: research at sec-consult dot com

EOF V. Paulikas / @2012

Copyright © 1995-2019 All rights reserved.