Security firm Core Security SDI Corp. and its SecureAuth division today published an advisory warning that they’ve discovered a serious vulnerability in SoftNAS Inc.‘s cloud data management platform that allows unauthenticated remote code execution with elevated permissions.

SoftNAS Cloud offers enterprise network-attached storage administration capabilities in cloud environments with support for leading providers, including Amazon Web Services, Microsoft Azure and VMware vSphere, supporting NFS, CIFS/SMB, iSCSI and AFP file protocols.

Used as a dedicated data onramp and express lane to manage, move, secure and store business applications and data, SoftNAS claims customers such as Samsung Electronics Co. Ltd., Toyota Motor Co., Netflix Inc., Salesforce Inc., The Coca-Cola Co. and The Boeing Co.

The vulnerability is found in the web administration console and allows an unauthenticated attacker to execute arbitrary system commands with root permissions. It involves an issue in the endpoint within the SoftNAS platform that is tasked with checking and executing update operations.

“This script doesn’t sanitize some inputs parameters before executing system commands and doesn’t have a session verification,” a spokesperson for SecureAuth + CoreSecurity explained to SiliconANGLE. “In addition, the web server runs with a sudo user. So, via a GET request an attacker could execute malicious code as root and gets, for example, a remote shell.”

More technically, as detailed in CVE-2018-14417, the ‘recentVersion’ parameter from the snserv endpoint is vulnerable to OS Command Injection when check and execute update operations are performed. This endpoint has no authentication/session verification. Therefore, it is possible for an unauthenticated attacker to execute malicious code in the target server. Because the web server runs a Sudoer user (apache), the malicious code can be executed with root permissions.

The good news is that the vulnerability has been addressed in an updated version of SoftNAS – 4.0.3. But it does require users to install the update, something that SecureAuth + CoreSecurity are encouraging all users of the product to do as soon as possible.

Image: SoftNAS