CVE-2022-32553
📋 TL;DR
This vulnerability allows logged-in users on affected Pure Storage FlashArray and FlashBlade systems to escalate privileges by manipulating environment variables. Attackers can escape restricted shells to gain unrestricted root access. Only users with existing shell access to these storage systems are affected.
💻 Affected Systems
- Pure Storage FlashArray
- Pure Storage FlashBlade
📦 What is this software?
Purity\/\/fa by Purestorage
Purity\/\/fa by Purestorage
Purity\/\/fa by Purestorage
Purity\/\/fa by Purestorage
Purity\/\/fb by Purestorage
Purity\/\/fb by Purestorage
Purity\/\/fb by Purestorage
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root access, allowing data theft, destruction, or ransomware deployment across connected storage infrastructure.
Likely Case
Privileged insider or compromised user account escalates to root, potentially accessing sensitive data or disrupting storage operations.
If Mitigated
Limited impact if proper access controls restrict shell access to trusted administrators only.
🎯 Exploit Status
Requires authenticated shell access. Exploitation involves environment variable manipulation to escape restricted shells.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply security bundle 2022-04-04 or upgrade to unaffected versions: FlashArray Purity//FA 6.2.4+, 6.1.13+, 6.0.9+, 5.3.18+; FlashBlade Purity//FB 3.3.1+, 3.2.5+, 3.1.13+
Vendor Advisory: https://support.purestorage.com/Pure_Security/Security_Bundle_2022-04-04/Security_Advisory_for_%E2%80%9Csecurity-bundle-2022-04-04
Restart Required: Yes
Instructions:
1. Download security bundle 2022-04-04 from Pure Storage support portal. 2. Apply via self-serve opt-in patch, manual patch application, or upgrade to unaffected Purity version. 3. Reboot affected systems after patch application.
🔧 Temporary Workarounds
Restrict Shell Access
allLimit shell access to only essential administrative users to reduce attack surface.
🧯 If You Can't Patch
- Implement strict access controls to limit shell access to trusted administrators only
- Monitor shell sessions and environment variable modifications for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check Purity version via Pure Storage management interface or CLI: 'pureversion' commandCheck Version:
pureversionVerify Fix Applied:
Verify version is patched: FlashArray Purity//FA 6.2.4+, 6.1.13+, 6.0.9+, 5.3.18+; FlashBlade Purity//FB 3.3.1+, 3.2.5+, 3.1.13+📡 Detection & Monitoring
Log Indicators:
- Unusual shell escalation attempts
- Environment variable manipulation in shell sessions
- Root privilege acquisition from non-admin users
Network Indicators:
- Unusual SSH or console access patterns to storage systems
SIEM Query:
source="pure-storage" AND (event_type="shell_escape" OR user_privilege_change="root")