UPDATED 12:00 EDT / JULY 26 2018


Advisory warns of serious vulnerability in SoftNAS cloud data management platform

Security firm Core Security SDI Corp. and its SecureAuth division today published an advisory warning that they’ve discovered a serious vulnerability in SoftNAS Inc.‘s cloud data management platform that allows unauthenticated remote code execution with elevated permissions.

SoftNAS Cloud offers enterprise network-attached storage administration capabilities in cloud environments with support for leading providers, including Amazon Web Services, Microsoft Azure and VMware vSphere, supporting NFS, CIFS/SMB, iSCSI and AFP file protocols.

Used as a dedicated data onramp and express lane to manage, move, secure and store business applications and data, SoftNAS claims customers such as Samsung Electronics Co. Ltd., Toyota Motor Co., Netflix Inc., Salesforce Inc., The Coca-Cola Co. and The Boeing Co.

The vulnerability is found in the web administration console and allows an unauthenticated attacker to execute arbitrary system commands with root permissions. It involves an issue in the endpoint within the SoftNAS platform that is tasked with checking and executing update operations.

“This script doesn’t sanitize some inputs parameters before executing system commands and doesn’t have a session verification,” a spokesperson for SecureAuth + CoreSecurity explained to SiliconANGLE. “In addition, the web server runs with a sudo user. So, via a GET request an attacker could execute malicious code as root and gets, for example, a remote shell.”

More technically, as detailed in CVE-2018-14417, the ‘recentVersion’ parameter from the snserv endpoint is vulnerable to OS Command Injection when check and execute update operations are performed. This endpoint has no authentication/session verification. Therefore, it is possible for an unauthenticated attacker to execute malicious code in the target server. Because the web server runs a Sudoer user (apache), the malicious code can be executed with root permissions.

The good news is that the vulnerability has been addressed in an updated version of SoftNAS – 4.0.3. But it does require users to install the update, something that SecureAuth + CoreSecurity are encouraging all users of the product to do as soon as possible.

Image: SoftNAS

A message from John Furrier, co-founder of SiliconANGLE:

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.

Join Our Community 

Click here to join the free and open Startup Showcase event.

“TheCUBE is part of re:Invent, you know, you guys really are a part of the event and we really appreciate your coming here and I know people appreciate the content you create as well” – Andy Jassy

We really want to hear from you, and we’re looking forward to seeing you at the event and in theCUBE Club.

Click here to join the free and open Startup Showcase event.