# CVE-2022-29844: A Classic Buffer Overflow On The Western Digital My Cloud Pro Series PR4100

Unauthenticated buffer overflow in WD My Cloud PR4100 Pure-FTPd douser() overwrites loggedin and wd globals, bypassing auth and ACLs to read/write arbitrary files and gain root RCE.

- Payout: $40,000
- Severity: critical
- Program: Western Digital
- Credited: Luca Moro
- Disclosed: 2023-04-20
- CVE: CVE-2022-29844
- Write-up quality: 9/10
- Original: https://www.zerodayinitiative.com/blog/2023/4/19/cve-2022-29844-a-classic-buffer-overflow-on-the-western-digital-my-cloud-pro-series-pr4100
- Library page: https://bugbountylibrary.com/r/blog%3Azerodayinitiative-com-blog-2023-4-19-cve-2022-29844-a-classic-buffer-overflow-on-the-western-digital-my-cloud-pro-series
- Tags: domain:iot domain:network impact:data-leak impact:rce kind:bounty platform:blog sev:critical technique:chained technique:reverse-engineering technique:source-review vuln:access-control vuln:auth-bypass vuln:memory-corruption

**Target:** Pure-FTPd FTP service on My Cloud PR4100 NAS
**Root cause:** WD's patched douser() does strncpy of user-controlled username into fixed 2048-byte auth_name in .bss without bounds check, overflowing adjacent globals loggedin and wd.
**Steps:**
1. Extract firmware SquashFS and GPL source; inspect WD patches under pure-ftpd-1.0.47/patch/
2. Send `user ` with >2048-byte username (no NULL bytes) to overflow auth_name into loggedin and wd
3. Set loggedin nonzero to bypass authentication; process stays root (no setuid)
4. `cwd share1` (Public share) to set allowed=2, or `cwd /` to set allowed=1
5. Re-send overflow to zero out wd so wd_tmp[0]==0, making check_allowed return prior allowed value
6. `cwd etc/NAS_CFG/` (no leading slash) to bypass ACL; `retr ftp.xml` to read share config
7. Repeat with write perms and `stor` (after `port`) to write /var/www/cmd.php PHP webshell
8. Request /cmd.php?cmd=... to execute uploaded /tmp/python_shell.py reverse shell as root
**How found:** Reverse-engineered firmware and audited WD's GPL patches to Pure-FTPd; spotted unbounded strncpy in douser() and mapped adjacent .bss globals (loggedin, wd) to plan overflow-driven auth and ACL bypass.
**Exploitation:** Unauthenticated attacker over FTP: overflow username to set loggedin and control wd, chain cwd/retr/stor to read /etc/NAS_CFG/ftp.xml for share names, then write PHP webshell to /var/www/cmd.php and execute a Python reverse shell for root code execution.
**Escalation:** Auth bypass via loggedin overflow plus ACL bypass via wd overwrite yields arbitrary file read/write, escalated to root RCE by dropping webshell in webroot.
**Insight:** When a vendor patches open-source daemons, diff their patches against upstream: custom strncpy into .bss globals lets you overwrite adjacent state (auth flags, cwd path) rather than just crash, turning a memory bug into logic bypass.