CVE-2021-37105
📋 TL;DR
CVE-2021-37105 is an improper file upload vulnerability in Huawei FusionCompute virtualization software. Attackers can upload malicious files without proper validation, potentially causing service disruption. This affects organizations running vulnerable versions of FusionCompute.
💻 Affected Systems
- Huawei FusionCompute
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of the FusionCompute platform, potentially affecting all virtualized workloads and management functions.
Likely Case
Service instability or denial of service through malicious file uploads, impacting virtualization management capabilities.
If Mitigated
Minimal impact with proper network segmentation and access controls limiting upload functionality to authorized users only.
🎯 Exploit Status
Exploitation requires access to the file upload functionality, but specific authentication requirements are not detailed in the advisory
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to versions beyond those listed in affected systems
Vendor Advisory: https://www.huawei.com/en/psirt/security-advisories/huawei-sa-20210922-01-upload-en
Restart Required: Yes
Instructions:
1. Check current FusionCompute version. 2. Download appropriate patch from Huawei support portal. 3. Apply patch following Huawei's update procedures. 4. Restart affected services or system as required.
🔧 Temporary Workarounds
Restrict File Upload Access
allLimit network access to FusionCompute management interface and file upload functionality
Implement File Upload Validation
allAdd additional file type and content validation at network perimeter or reverse proxy
🧯 If You Can't Patch
- Isolate FusionCompute management interface to trusted networks only
- Implement strict access controls and monitoring for file upload activities
🔍 How to Verify
Check if Vulnerable:
Check FusionCompute version via management interface or CLI. If version is 6.5.0, 6.5.1, or 8.0.0, system is vulnerable.Check Version:
Specific command varies by deployment - typically available through FusionCompute management interface or vendor-provided CLI toolsVerify Fix Applied:
Verify version has been updated beyond affected versions and test file upload functionality with controlled test files.📡 Detection & Monitoring
Log Indicators:
- Unusual file upload activities
- Multiple failed upload attempts
- Uploads of unexpected file types
Network Indicators:
- Unusual traffic patterns to file upload endpoints
- Multiple upload requests from single source
SIEM Query:
source="fusioncompute" AND (event="file_upload" OR url_path="*upload*") AND (file_type!="expected_type" OR size>threshold)