WD ShareSpace WEB GUI Sensitive Data Disclosure

SEC Consult Vulnerability Lab Security Advisory < 20120618-0 >


title: WD ShareSpace WEB GUI Sensitive Data Disclosure

product: WD ShareSpace network storage system

vulnerable version: WD ShareSpace <= v2.3.02 (D and E series)

fixed version: none

impact: High

homepage: support.wdc.com/product/download.asp

found: 2012-01-31

by: V. Paulikas

SEC Consult Vulnerability Lab




Vendor description:


WD ShareSpace is high-speed network-attached storage system with capacities up

to 8 TB and a space-saving footprint gives you all the benefits of a big time

data center without the need for a big time IT department. Perfect for

centralizing and sharing data and multimedia files on a small office or home



Source: www.wdc.com/wdproducts/library/AAG/ENG/4178-705023.pdf




Vulnerability overview/description:


WD ShareSpace network storage system has a built-in WEB GUI that is used to

administer the ShareSpace device. The built-in WEB GUI is prone to a sensitive

data disclosure due to an improper configuration of access rights of the

configuration file config.xml. By directly accessing the config.xml file

without authentication it is possible to obtain system's configuration data,

which includes network settings, shared folder names, SMB users and hashed

passwords, administrator's credentials, etc.



Proof of concept:


The vulnerability is exploited by accessing the config.xml file directly with

a browser.


PoC URL has been removed as no vendor patch is available.



Vulnerable / tested versions:


WD ShareSpace v2.3.01




Vendor contact timeline:


2012-02-17: Contacting vendor through help center (http://wdc.custhelp.com/app/ask/).

2012-02-24: Vendor response, issue is being forwarded to the

appropriate product development team (Level 2 team as by WD) for

review and confirmation. Case 120217-002268 opened.

2012-03-02: Vendor response, issue has been reviewed, additional information


2012-03-07: Providing additional information regarding the vulnerability.

2012-03-12: Vendor response, vulnerability escalated to their engineering team

to verify and fix if possible.

2012-04-19: Asking if the vulnerability was fixed because of long response time.

2012-04-24: Vendor response, vulnerability not resolved.

2012-05-03: Vendor response, firmware update available, not related to


2012-05-07: Asking vendor to recheck if firmware update really solves the


2012-05-09: Vendor confirms, that the new firmware does not solve the problem.

2012-05-10: Asking vendor for more indepth research of the issue

2012-05-15: Vendor confirms the issue: ShareSpace running firmware version

2.3.02 (D and E series) is affected.

Vendor disagrees that it's a security vulnerability.

2012-05-31: Informing vendor about the release of the advisory on 2012-06-18.

No answer.

2012-06-11: Informing vendor once more about the release of advisory on 2012-06-18.

No answer.

2012-06-18: No further response from vendor. Advisory published according to

the SEC Consult's responsible disclosure policy.






No patch available.





Allow access to the administrative interface only from trusted networks.




Advisory URL:






SEC Consult Unternehmensberatung GmbH


Office Vienna

Mooslackengasse 17

A-1190 Vienna



Tel.: +43 / 1 / 890 30 43 - 0

Fax.: +43 / 1 / 890 30 43 - 25

Mail: research at sec-consult dot com



EOF V. Paulikas / @2012