CVE-2024-22169: WD Discovery RCE Vulnerability

CVE-2024-22169 Overview

CVE-2024-22169 affects Western Digital's WD Discovery desktop application in versions prior to 5.0.589. The vulnerability stems from a misconfiguration in the Node.js environment settings within the Electron framework. Attackers can abuse the ELECTRON_RUN_AS_NODE environment variable to execute arbitrary code inside the WD Discovery application context. Any malicious application running with standard user permissions can trigger this flaw on a system where WD Discovery is installed. Western Digital released version 5.0.589 to address the issue by disabling specific Electron features and fuses. This vulnerability is classified as [CWE-94] (Improper Control of Generation of Code).

Critical Impact
A local attacker with standard user privileges can execute arbitrary code within the trusted context of the WD Discovery application, enabling code injection and potential integrity compromise of the host system.

Affected Products

WD Discovery desktop application versions prior to 5.0.589
Windows and macOS systems with WD Discovery installed
Western Digital storage ecosystem endpoints relying on WD Discovery

Discovery Timeline

2024-08-02 - CVE-2024-22169 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-22169

Vulnerability Analysis

WD Discovery is built on the Electron framework, which bundles Chromium and Node.js into a desktop application runtime. Electron exposes the ELECTRON_RUN_AS_NODE environment variable to allow the packaged binary to run as a plain Node.js interpreter. When this behavior is left enabled and Electron fuses are not hardened, any process on the local machine can spawn the WD Discovery executable with ELECTRON_RUN_AS_NODE=1 and pass arbitrary JavaScript for execution. The code then runs under the identity, code signature, and application context of WD Discovery.

This technique is commonly used for signed-binary proxy execution and defense evasion. Because the target binary is signed by Western Digital, malicious code inherits the trust of a legitimate installed application. Attackers can leverage this to bypass application allow-listing controls that trust the WD Discovery process.

Root Cause

The root cause is an insecure default configuration of the Electron runtime shipped with WD Discovery. The application did not disable the runAsNode fuse or the nodeCliInspect fuse, and it did not filter the ELECTRON_RUN_AS_NODE environment variable at process launch. Electron fuses are compile-time toggles that control sensitive runtime behaviors, and leaving runAsNode enabled turns the packaged binary into a general-purpose Node.js interpreter.

Attack Vector

Exploitation requires local access with standard user permissions and user interaction on a system where WD Discovery is installed. A malicious binary or script sets ELECTRON_RUN_AS_NODE=1 in its environment and then invokes the WD Discovery main executable, passing a -e JavaScript payload or a script path as an argument. The Electron binary detects the environment variable and behaves as a Node.js runtime, executing the attacker-controlled JavaScript. The resulting child process appears in telemetry as a legitimate Western Digital signed binary rather than as a suspicious script host.

No verified public proof-of-concept code is available for this CVE. See the Western Digital Security Advisory for vendor technical details.

Detection Methods for CVE-2024-22169

Indicators of Compromise

Process creation events where the WD Discovery executable is launched with the ELECTRON_RUN_AS_NODE environment variable set to 1.
WD Discovery process command lines containing Node.js flags such as -e, --eval, --inspect, or a .js script path.
Unexpected child processes (for example cmd.exe, powershell.exe, or shell utilities) spawned by the WD Discovery binary.

Detection Strategies

Build EDR rules that alert when any Electron-based application is launched with ELECTRON_RUN_AS_NODE set, correlating on parent process identity and command-line arguments.
Hunt for signed-binary proxy execution patterns aligned to MITRE ATT&CK technique T1218, focused on Western Digital signed executables.
Baseline the normal command-line arguments used by WD Discovery in your environment and alert on deviations, especially JavaScript execution flags.

Monitoring Recommendations

Ingest process creation and environment variable telemetry (for example Sysmon Event ID 1 with CaptureEnvironment where available) into your SIEM or data lake for retrospective hunting.
Monitor outbound network connections initiated by the WD Discovery process for indicators of command-and-control traffic.
Track file writes and registry modifications performed by the WD Discovery process to identify post-exploitation persistence attempts.

How to Mitigate CVE-2024-22169

Immediate Actions Required

Upgrade WD Discovery to version 5.0.589 or later on all Windows and macOS endpoints where it is installed.
Inventory endpoints for the presence of WD Discovery and remove the application from systems that do not require it.
Restrict standard user ability to run arbitrary executables from user-writable directories through application control policies.

Patch Information

Western Digital addressed CVE-2024-22169 in WD Discovery version 5.0.589 by disabling the affected Electron features and fuses, including runAsNode. Refer to the vendor advisory WDC-24004 for the official patch and download instructions. There are no supported backported fixes for earlier versions; upgrading is the only vendor-supported remediation.

Workarounds

Uninstall WD Discovery from endpoints where it is not required until patching is complete.
Use application control tooling (for example Windows Defender Application Control or AppLocker) to block execution of vulnerable WD Discovery versions.
Configure endpoint policies to strip the ELECTRON_RUN_AS_NODE environment variable from child processes of untrusted parents where feasible.

bash

# Example: verify installed WD Discovery version on Windows (PowerShell)
Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "WD Discovery*" } |
  Select-Object DisplayName, DisplayVersion, Publisher

# Example: verify installed WD Discovery version on macOS
defaults read "/Applications/WD Discovery.app/Contents/Info.plist" CFBundleShortVersionString