CVE-2022-22561
📋 TL;DR
Dell PowerScale OneFS versions 8.2.x through 9.3.0.x have an authentication rate limiting vulnerability that allows unauthenticated remote attackers to perform brute-force attacks. This could lead to compromised administrative or user accounts on affected storage systems.
💻 Affected Systems
- Dell PowerScale OneFS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access to the storage system, allowing data theft, destruction, or ransomware deployment across the entire storage infrastructure.
Likely Case
Attackers compromise user accounts with weak passwords, gaining access to sensitive data stored on the affected PowerScale systems.
If Mitigated
Attack attempts are detected and blocked by network controls, with strong passwords preventing successful brute-force.
🎯 Exploit Status
Brute-force attacks are well-understood and easily automated, making exploitation straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OneFS 9.4.0.0 and later
Vendor Advisory: https://www.dell.com/support/kbdoc/000195815
Restart Required: No
Instructions:
1. Check current OneFS version with 'isi version'. 2. If vulnerable, upgrade to OneFS 9.4.0.0 or later following Dell's upgrade procedures. 3. No cluster restart required for patch application.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to PowerScale management interfaces to trusted networks only
Account Lockout Policy
allImplement external authentication with account lockout policies via LDAP/AD integration
🧯 If You Can't Patch
- Implement strict network segmentation to isolate PowerScale management interfaces
- Enforce strong password policies and multi-factor authentication for all accounts
🔍 How to Verify
Check if Vulnerable:
Run 'isi version' on PowerScale node and check if version is between 8.2.x and 9.3.0.xCheck Version:
isi versionVerify Fix Applied:
Run 'isi version' and confirm version is 9.4.0.0 or higher📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts from single IP
- Unusual authentication patterns in access logs
Network Indicators:
- High volume of authentication requests to PowerScale management ports
- Brute-force patterns in network traffic
SIEM Query:
source="powerscale" AND (event_type="authentication_failure" AND count > 10 within 5 minutes)