IBM FlashSystem authentication bypass

Vulnerability

An authentication bypass vulnerability exists in the RPCAdapter endpoint of IBM Storage Virtualize (GUI). Affected versions: 8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, and 8.7.2.0 through 8.7.2.1 [1]. The CLI is unaffected.

Exploitation

An unauthenticated remote attacker can bypass authentication by sending a specifically crafted HTTP request to the RPCAdapter endpoint. No user interaction or privileges are required [1].

Impact

Successful exploitation allows the attacker to bypass authentication, resulting in high confidentiality and integrity impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Availability is not affected [1].

Mitigation

IBM recommends upgrading to a fixed code level as specified in the security bulletin [1]. No workaround is available. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.