CVE-2017-17560

Related Files

Western Digital MyCloud multi_uploadify File Upload

Posted Dec 15, 2017

Authored by Zenofex | Site metasploit.com

This Metasploit module exploits a file upload vulnerability found in Western Digital's MyCloud NAS web administration HTTP service. The /web/jquery/uploader/multi_uploadify.php PHP script provides multipart upload functionality that is accessible without authentication and can be used to place a file anywhere on the device's file system. This allows an attacker the ability to upload a PHP shell onto the device and obtain arbitrary code execution as root.

tags | exploit, web, arbitrary, shell, root, php, code execution, file upload

advisories | CVE-2017-17560

SHA-256 | 33807dc92c51e0890223cb5aa8b949a564e99406df84abf4910ba71ac13c7512

Download | Favorite | View