CVE-2024-0003
📋 TL;DR
This vulnerability allows a malicious user to exploit a remote administrative service in FlashArray Purity to create unauthorized privileged accounts on the storage array. This affects organizations using vulnerable versions of Pure Storage FlashArray systems. Attackers could gain administrative control over storage infrastructure.
💻 Affected Systems
- Pure Storage FlashArray with Purity operating environment
📦 What is this software?
Purity\/\/fa by Purestorage
Purity\/\/fa by Purestorage
Purity\/\/fa by Purestorage
Purity\/\/fa by Purestorage
Purity\/\/fa by Purestorage
Purity\/\/fa by Purestorage
Purity\/\/fa by Purestorage
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of storage array with administrative privileges, allowing data theft, destruction, or ransomware deployment across connected systems.
Likely Case
Unauthorized administrative access leading to data exfiltration, configuration changes, or service disruption.
If Mitigated
Limited impact if network segmentation and access controls prevent unauthorized access to administrative interfaces.
🎯 Exploit Status
Exploitation requires access to the administrative service but appears straightforward based on CWE-269 (Improper Privilege Management).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Specific version not provided; check Pure Storage advisory for patched versions.
Vendor Advisory: https://purestorage.com/security
Restart Required: No
Instructions:
1. Review Pure Storage security advisory for affected versions. 2. Apply the recommended Purity update via Pure Storage support or management interface. 3. Verify the update completes successfully.
🔧 Temporary Workarounds
Restrict Administrative Access
allLimit network access to FlashArray administrative services to trusted IP addresses only.
Configure firewall rules to restrict access to FlashArray management IP/ports (e.g., 443/TCP) to authorized networks.
Disable Unnecessary Services
allDisable remote administrative services if not required for operations.
Consult Pure Storage documentation to disable specific administrative services via CLI or GUI.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FlashArray management interfaces from untrusted networks.
- Enforce multi-factor authentication and strong access controls for administrative accounts.
🔍 How to Verify
Check if Vulnerable:
Check Purity version against Pure Storage advisory; if running an affected version and administrative services are accessible, system is vulnerable.Check Version:
From FlashArray CLI: pureversion or from GUI: System > AboutVerify Fix Applied:
Verify Purity version is updated to a patched version listed in the Pure Storage advisory.📡 Detection & Monitoring
Log Indicators:
- Unexpected account creation events in FlashArray logs
- Unauthorized access attempts to administrative services
Network Indicators:
- Unusual traffic to FlashArray administrative ports from untrusted sources
SIEM Query:
Example: source="flasharray" AND (event_type="account_creation" OR auth_failure)