CVE-2023-22572
📋 TL;DR
Dell PowerScale OneFS versions 9.1.0.x through 9.4.0.x log sensitive information (likely passwords) when users change passwords via the API. A local attacker with low privileges could read these logs to obtain credentials, potentially leading to privilege escalation and system compromise.
💻 Affected Systems
- Dell PowerScale OneFS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attacker obtains administrative credentials from logs, gains full system control, and potentially compromises the entire PowerScale cluster.
Likely Case
Local attacker escalates privileges to gain unauthorized access to sensitive data or system functions.
If Mitigated
With proper log access controls and monitoring, impact is limited to potential credential exposure without successful exploitation.
🎯 Exploit Status
Exploitation requires local access and ability to read system logs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply Dell PowerScale OneFS security updates as specified in advisory.
Vendor Advisory: https://www.dell.com/support/kbdoc/en-us/000207863/dell-powerscale-onefs-security-updates-for-multiple-security
Restart Required: Yes
Instructions:
1. Review Dell advisory 000207863. 2. Download appropriate OneFS security update. 3. Apply update following Dell's upgrade procedures. 4. Restart affected services/systems.
🔧 Temporary Workarounds
Restrict Log Access
linuxLimit read access to system log files to authorized administrators only.
chmod 640 /var/log/*.log
setfacl -m u:admin:r /var/log/*.log
Disable Password Change API
linuxTemporarily disable the change password API if not required.
isi auth settings modify --password-change-api=false
🧯 If You Can't Patch
- Implement strict access controls on log directories and files.
- Monitor log access attempts and implement alerting for suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Check OneFS version with 'isi version' and verify if between 9.1.0.x and 9.4.0.x.Check Version:
isi versionVerify Fix Applied:
Verify version is updated beyond affected range and check logs no longer contain password information.📡 Detection & Monitoring
Log Indicators:
- Log entries containing password strings or credential information in clear text.
Network Indicators:
- Unusual local log access patterns from non-admin users.
SIEM Query:
source="/var/log/*.log" AND (password OR passwd OR credential) NOT admin_user