Support Product Security

Western Digital My Cloud OS 5, My Cloud Home, SanDisk ibi and WD Cloud Mobile and Web App Update

WDC Tracking Number: WDC-23004
Product Line: My Cloud, My Cloud Home, My Cloud Home Duo, SanDisk ibi, and WD Cloud
Published: March 5, 2023

Last Updated: March 24, 2023

Description

Western Digital My Cloud, My Cloud Home, SanDisk ibi and WD Cloud mobile and web apps have been updated to help improve the security of your devices and data.

Product Impact
Minimum Fix Version
Last Updated
ibi App - Android
4.21.0 or later
March 01, 2023
ibi App - iOS
4.21.0 or later
March 01, 2023
My Cloud Home App - Android
4.21.0 or later
March 01, 2023
My Cloud Home App - iOS
4.21.0 or later
March 01, 2023
My Cloud OS 5 App - Android
4.21.0 or later
March 01, 2023
My Cloud OS 5 App - iOS
4.21.0 or later
March 01, 2023
WD Cloud App - Android
4.21.0 or later
March 01, 2023
WD Cloud App - iOS
4.21.0 or later
March 01, 2023
ibi Web App
4.26.0-6126
March 08, 2023
My Cloud Home Web App
4.26.0-6126
March 08, 2023
My Cloud Web App
4.26.0-6126
March 08, 2023
WD Cloud Web App
4.26.0-6126
March 08, 2023

Users of the mobile apps should promptly update the apps to reflect the latest changes. The web apps have automatically been updated.

Advisory Summary

Addressed a security concern where a device API endpoint was missing access controls. Due to a permissive CORS policy and missing authentication requirement for private IPs, a remote attacker could obtain device information by convincing a victim user to visit an attacker-controlled server and issue a cross-site request. This was addressed by enforcing token-based authentication on the corresponding endpoint to avoid unauthorized information disclosures.

CVE Number: CVE-2023-22813

Compare