CVE-2022-45099
📋 TL;DR
This vulnerability in Dell PowerScale OneFS involves weak encoding for NDMP passwords, allowing a malicious privileged local attacker to potentially compromise the entire system. It affects versions 8.2.x through 9.4.x of Dell PowerScale OneFS.
💻 Affected Systems
- Dell PowerScale OneFS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise leading to complete control over the PowerScale cluster, data exfiltration, and potential lateral movement to connected systems.
Likely Case
Privileged local attacker gains elevated access to the OneFS system, potentially accessing sensitive data and disrupting operations.
If Mitigated
With proper access controls and monitoring, impact is limited to unauthorized access attempts that can be detected and contained.
🎯 Exploit Status
Exploitation requires local privileged access to the system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: OneFS 9.5.0.0 and later
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities
Restart Required: Yes
Instructions:
1. Review Dell advisory DSA-2022-282. 2. Upgrade to OneFS 9.5.0.0 or later. 3. Apply all security patches. 4. Restart affected services.
🔧 Temporary Workarounds
Disable NDMP Service
linuxIf NDMP functionality is not required, disable the service to eliminate the attack vector.
isi ndmp disable
Restrict Local Access
allImplement strict access controls to limit local privileged users who could exploit this vulnerability.
🧯 If You Can't Patch
- Implement network segmentation to isolate PowerScale systems from critical infrastructure.
- Enhance monitoring and logging for suspicious local privilege escalation attempts.
🔍 How to Verify
Check if Vulnerable:
Check OneFS version with 'isi version' command. If version is between 8.2.x and 9.4.x, system is vulnerable.Check Version:
isi versionVerify Fix Applied:
Verify version is 9.5.0.0 or later using 'isi version' command.📡 Detection & Monitoring
Log Indicators:
- Unusual NDMP authentication attempts
- Privilege escalation patterns in system logs
- Unauthorized access to sensitive files
Network Indicators:
- Unexpected NDMP traffic patterns
- Anomalous data transfers from PowerScale systems
SIEM Query:
source="powerscale" AND (event_type="authentication" OR event_type="privilege_escalation") AND result="failure"