<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;" dir="ltr">
<p>Hello,</p>
<p><br>
</p>
<p>The below signature is for detection a weak authentication bypass in WD MyCloud. No pcaps are available.</p>
<p><br>
</p>
<p><span style="font-size: 9pt; font-family: Consolas, monospace;">alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"SERVER-WEBAPP Western Digital MyCloud weak authentication bypass attempt"; flow:to_server,established; content:"/login_checker.php";
 fast_pattern:only; http_uri; content:"username=1"; http_cookie; content:"isAdmin=1"; http_cookie; metadata:ruleset community, http service; reference:url,vuldb.com/?id.96820; reference:url,security.szurek.pl/wd-my-cloud-mirror-211153-rce-and-authentication-bypass.html;
 classtype:attempted-admin; sid:1000833; rev:1;)</span><br>
</p>
<p><span><br>
</span></p>
<p><span>Thank you.</span></p>
<p><span>YM</span></p>
</div>
</body>
</html>