StarWind SAN and NAS v0.2 build 1914 allow remote code execution. A flaw was found in REST API in StarWind Stack. REST command, which allows changing the hostname, doesn’t check a new hostname parameter. It goes directly to bash as part of a script. An attacker with non-root user access can inject arbitrary data into the command that will be executed with root privileges.
Metrics
Affected Vendors & Products
References
Link | Providers |
---|---|
https://www.starwindsoftware.com/security/sw-20220531-0001/ |
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2022-06-03T05:19:38
Updated: 2024-08-03T07:39:50.388Z
Reserved: 2022-06-03T00:00:00
Link: CVE-2022-32268
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2022-06-03T06:15:07.517
Modified: 2022-11-16T16:56:12.613
Link: CVE-2022-32268
Redhat
No data.