Multiple vulnerabilities in the Brocade SANnav storage area network (SAN) management application could be exploited to compromise the appliance and Fibre Channel switches, security researcher Pierre Barre warns.
The researcher identified a total of 18 flaws in the appliance, including unauthenticated flaws allowing remote attackers to log in to vulnerable devices as root. Of these, nine were assigned CVE identifiers: CVE-2024-2859 and CVE-2024-29960 through CVE-2024-29967.
According to the researcher, three of these issues could allow an attacker to send malicious data and to intercept credentials sent in clear-text, potentially compromising the entire Fibre Channel infrastructure.
The first issue exists because the SANnav VM lacks a firewall by default, thus allowing an attacker to reach APIs for the Apache Kafka event streaming platform. The other two are rooted in the use of HTTP as the management protocol if HTTPS is blocked, and in syslog traffic being sent in clear-text.
Barre also discovered that the appliance has two backdoor user accounts, namely ‘root’ and ‘sannav’, and that the password for root is publicly known, as it has been included in the product’s documentation. The same password can be used for the sannav account as well.
While reviewing the SANnav configuration, the researcher also discovered that root access is available by default, that insecure options have been set in an OpenSSH configuration file, and that the appliance is sending HTTPS requests to two domains at regular intervals, without explanation.
Furthermore, SANnav has Postgres running without authentication and accessible from any Docker instance, allowing an unauthenticated attacker to gain read and write access to the database and dump the dcmdb database, which contains sensitive information, including administrative credentials.
Issues in the Postgres Docker instance, Barre says, could allow an attacker to overwrite critical files in the host and to exfiltrate backup files. Furthermore, Docker instances within the appliance have read/write access to critical mount points, allowing an attacker to take over the appliance by replacing binaries in specific directories.
Overall, SANnav uses 40 different Docker instances, and the researcher identified several vulnerabilities in them, including the fact that four instances have extensive permissions that could allow an attacker to take control of the appliance.
Additionally, Barre discovered that backup files expose credentials and configuration information and can be retrieved and mounted on malicious appliances, that SANnav has inconsistent firewall rules and insecure file permissions, that Kafka can be reached from the WAN interface, and that the appliance uses hardcoded SSH and Docker keys.
Barre initially discovered the flaws in 2022, in SANnav version 2.1.1, but his report was rejected, as Brocade had already released version 2.2.2 of the application and that had not been tested by the researcher. After confirming that the bugs were still present in the newer release, he re-submitted the report in May 2023.
The storage networking solutions provider acknowledged the issues and patched them in SANnav version 2.3.1, which was released in December 2023. Last week, Brocade parent company Broadcom published advisories detailing nine of the addressed flaws.
On April 18, Hewlett Packard Enterprise (HPE) announced that patches for eight of these flaws were included in HPE SANnav Management Portal versions 2.3.0a and 2.3.1.
Related: CrushFTP Patches Exploited Zero-Day Vulnerability
Related: Cisco Says PoC Exploit Available for Newly Patched IMC Vulnerability
Related: Brocade Vulnerabilities Could Impact Storage Solutions of Several Major Companies
