StarWind SAN and NAS v0.2 build 1914 allow remote code execution. A flaw was found in REST API in StarWind Stack. REST command, which allows changing the hostname, doesn’t check a new hostname parameter. It goes directly to bash as part of a script. An attacker with non-root user access can inject arbitrary data into the command that will be executed with root privileges.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-06-03T05:19:38

Updated: 2024-08-03T07:39:50.388Z

Reserved: 2022-06-03T00:00:00

Link: CVE-2022-32268

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2022-06-03T06:15:07.517

Modified: 2022-11-16T16:56:12.613

Link: CVE-2022-32268

cve-icon Redhat

No data.