CVE-2024-0001
📋 TL;DR
A local administrative account intended for initial FlashArray configuration remains active after setup, allowing attackers with local access to gain elevated privileges. This affects Pure Storage FlashArray systems running vulnerable Purity versions. Organizations using these storage arrays are at risk.
💻 Affected Systems
- Pure Storage FlashArray
📦 What is this software?
Purity\/\/fa by Purestorage
Purity\/\/fa by Purestorage
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of FlashArray storage system with administrative control over all data, configuration, and connected systems.
Likely Case
Unauthorized administrative access leading to data theft, configuration changes, or service disruption.
If Mitigated
Limited impact if proper network segmentation and access controls prevent local access to management interfaces.
🎯 Exploit Status
Requires local access to management interface but simple to execute once access is obtained
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Pure Storage advisory for specific fixed versions
Vendor Advisory: https://purestorage.com/security
Restart Required: Yes
Instructions:
1. Review Pure Storage security advisory. 2. Apply recommended Purity update. 3. Verify initial configuration account is disabled. 4. Restart affected systems as required.
🔧 Temporary Workarounds
Disable Initial Configuration Account
allManually disable the initial configuration account if patch cannot be applied immediately
# Consult Pure Storage documentation for account disablement commands
Restrict Management Interface Access
allLimit network access to FlashArray management interfaces
# Configure firewall rules to restrict access to management IPs/ports
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FlashArray management interfaces
- Enable multi-factor authentication and strict access controls for administrative accounts
🔍 How to Verify
Check if Vulnerable:
Check if initial configuration account exists and is enabled in Purity management interfaceCheck Version:
# purearray list --version (or equivalent Pure Storage CLI command)Verify Fix Applied:
Verify account is disabled and Purity version matches patched version from advisory📡 Detection & Monitoring
Log Indicators:
- Unusual login attempts to initial configuration account
- Administrative actions from unexpected accounts
Network Indicators:
- Unauthorized access attempts to FlashArray management ports
SIEM Query:
source="flasharray" AND (event_type="login" AND user="initial_config*")