CVE-2024-0004

An authenticated user with the array admin role can send specially crafted commands to the FlashArray Purity system over the network, without requiring interaction from other users. The vulnerability is classified as CWE-94 (code injection), meaning the system fails to properly neutralize input data before interpreting it as code. This results in the possibility of privilege escalation beyond the level granted to the array admin role, potentially to the system level on the storage array.

An attacker with array admin privileges can escalate their privileges on the device and gain full control over the FlashArray storage array, creating a risk of breach of confidentiality, integrity, and availability of stored data.

Apply patches available from the vendor in accordance with references published on https://purestorage.com/security. Additionally, it is recommended to restrict access to accounts with the array admin role only to trusted and necessary users and to monitor administrative activity on FlashArray devices.

Pure Storage FlashArray Purity — versions indicated in vendor references (https://purestorage.com/security)