CVE-2023-22817 Server-side Request Forgery vulnerability in Western Digital My Cloud, My Cloud Home and SanDisk ibi products

Medium 5.5 Published 5 Feb 2024 Updated 2 Aug 2024

A rogue local server can exploit SSRF to bypass network restrictions and target internal services on Western Digital NAS devices.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-22817?

CVE-2023-22817 is a medium-severity server-side request forgery vulnerability in SanDisk My Cloud Home & Duo, published on 5 Feb 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Server-side request forgery (SSRF) vulnerability that could allow a rogue server on the local network to modify its URL using another DNS address to point back to the loopback adapter. This could then allow the URL to exploit other vulnerabilities on the local server. This was addressed by fixing DNS addresses that refer to loopback. This issue affects My Cloud OS 5 devices before 5.27.161, My Cloud Home, My Cloud Home Duo and SanDisk ibi devices before 9.5.1-104.

Weakness: CWE-918

Which versions are affected by CVE-2023-22817?

It affects 13 products.

Products include Westerndigital My Cloud Dl2100 Firmware, Westerndigital My Cloud Dl4100 Firmware, Westerndigital My Cloud Ex2100 Firmware, Westerndigital My Cloud Ex2 Ultra Firmware, Westerndigital My Cloud Ex4100 Firmware, Westerndigital My Cloud Glacier Firmware and 7 more.

How do I fix CVE-2023-22817?

No fix has been published for CVE-2023-22817 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2023-22817 being exploited?

There is no known exploitation of CVE-2023-22817 in the wild and no public exploit code.

Sources

Also known as GHSA-ff78-2q7q-3gpw.