CVE-2024-30213, CVE-2024-31947: Blind Operating System Command Injection and Path Traversal in StoneFly Storage Concentrator
Stroz Friedberg discovered two security vulnerabilities affecting StoneFly Storage Concentrator (SC) and Storage Concentrator Virtual Machine (SCVM) leading to arbitrary command execution and information disclosure, both requiring user authentication. The vulnerabilities affect SC and SCVM running version 8.0.4.25 and below. The vulnerabilities were discovered by Stroz Friedberg team member David Glenn Baylon.
Stroz Friedberg would like to thank StoneFly for working with us as part of our coordinated disclosure process.
Timeline
- 01/09/24 - Initial disclosure to support@stonefly.com
- 01/16/24 - Issues confirmed by StoneFly
- 04/24/24 - CVEs assigned by StoneFly
- 07/01/24 - StoneFly SC and SCVM patches released
- 07/08/24 - CVE-2024-30213 advisory published
- 07/11/24 - CVE-2024-31947 advisory published
- 08/16/24 - Stroz Friedberg advisory published
Vulnerability Listing
- CVE-2024-30213 - Blind Operating System Command Injection
- CVE-2024-31947 - Path Traversal
Vendor Advisory
CVE-2024-30213 - Blind Operating System Command Injection
Overview
StoneFly SC and SCVM are vulnerable to authenticated blind operating system command injection attacks. Successful exploitation of this vulnerability leads to privileged arbitrary command execution, resulting in complete compromise of an SC and/or SCVM.
Remediation
Refer to the vendor pages listed under Vendor Advisory for a complete list of product versions in which this vulnerability has been fixed and further instructions on how to upgrade the affected systems.
CVE-2024-31947 - Path Traversal
Overview
StoneFly SC and SCVM are vulnerable to authenticated path traversal attacks. Successful exploitation of this vulnerability leads to disclosure of sensitive information.
Remediation
Refer to the vendor pages listed under Vendor Advisory for a complete list of product versions in which this vulnerability has been fixed and further instructions on how to upgrade the affected systems.
