CVE-2022-32554
📋 TL;DR
This vulnerability exposes credentials for Pure Storage FlashArray and FlashBlade management interfaces, potentially allowing attackers with network access to execute arbitrary commands with root privileges. Affected systems include Pure Storage FlashArray running Purity//FA 6.2.0-6.2.3, 6.1.0-6.1.12, 6.0.0-6.0.8, 5.3.0-5.3.17, 5.2.x and prior, and FlashBlade running Purity//FB 3.3.0, 3.2.0-3.2.4, 3.1.0-3.1.12, 3.0.x and prior.
💻 Affected Systems
- Pure Storage FlashArray
- Pure Storage FlashBlade
📦 What is this software?
Purity\/\/fa by Purestorage
Purity\/\/fa by Purestorage
Purity\/\/fa by Purestorage
Purity\/\/fa by Purestorage
Purity\/\/fb by Purestorage
Purity\/\/fb by Purestorage
Purity\/\/fb by Purestorage
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root-level access, allowing data theft, destruction, or ransomware deployment across the storage infrastructure.
Likely Case
Unauthorized access to management interface leading to configuration changes, data access, or service disruption.
If Mitigated
Limited impact if management interfaces are properly segmented and access-controlled.
🎯 Exploit Status
Exploitation requires network access to management interface and knowledge of exposed credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply security bundle 2022-04-04 or upgrade to unaffected versions: Purity//FA 6.2.4+, 6.1.13+, 6.0.9+, 5.3.18+; Purity//FB 3.3.1+, 3.2.5+, 3.1.13+
Vendor Advisory: https://support.purestorage.com/Pure_Security/Security_Bundle_2022-04-04/Security_Advisory_for_%E2%80%9Csecurity-bundle-2022-04-04
Restart Required: Yes
Instructions:
1. Download security bundle 2022-04-04 from Pure Storage support portal. 2. Apply via self-serve opt-in patch, manual patch application, or upgrade to unaffected Purity version. 3. Restart affected systems as required.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to management interfaces using firewall rules and network segmentation.
Access Control Lists
allImplement strict IP-based access controls for management interfaces.
🧯 If You Can't Patch
- Immediately isolate management interfaces from untrusted networks and internet
- Implement multi-factor authentication and strong access controls for management access
🔍 How to Verify
Check if Vulnerable:
Check Purity version via Pure Storage management interface or CLI: pureversionCheck Version:
pureversionVerify Fix Applied:
Verify version is updated to patched version and security bundle 2022-04-04 is applied📡 Detection & Monitoring
Log Indicators:
- Unauthorized login attempts to management interface
- Unexpected configuration changes
- Root-level command execution
Network Indicators:
- Unusual traffic to management interface ports
- Connection attempts from unexpected sources
SIEM Query:
source="purestorage" AND (event_type="authentication_failure" OR event_type="privileged_command")