CVE-2022-32552

Privilege escalation via Python environment variables in Pure Storage FlashArray and FlashBlade products

• CVSS 8.8
• CWE-16: Configuration
• Authentication, Authorization, and Session Management
• Local

Pure Storage FlashArray products running Purity//FA 6.2.0 – 6.2.3, 6.1.0 – 6.1.12, 6.0.0 – 6.0.8, 5.3.0 – 5.3.17, 5.2.x and prior Purity//FA releases, and Pure Storage FlashBlade products running Purity//FB 3.3.0, 3.2.0 – 3.2.4, 3.1.0 – 3.1.12, 3.0.x and prior Purity//FB releases are vulnerable to a privilege escalation via the manipulation of Python environment variables which can be exploited by a logged-in user to escape a restricted shell to an unrestricted shell with root privileges. No other Pure Storage products or services are affected. Remediation is available from Pure Storage via a self-serve “opt-in” patch, manual patch application or a software upgrade to an unaffected version of Purity software.

CVE

CVE-2022-32552

CWE

CWE-16: Configuration

CVSS base score

8.8

Published

2022-06-23

OWASP

A07 Identification and Authentication Failures

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Local

Impact

Privilege Escalation

Fixed by upgrading

Yes

Solution

Update to a fixed version of Purity//FA or Purity//FB software.

import os
import subprocess

def execute(command):
    """Vulnerable function that demonstrates the security issue."""
    env = os.environ.copy()
    env['PATH'] = '/usr/local/bin:/usr/bin:/bin'

    result = subprocess.run(command, shell=True, env=env, capture_output=True, text=True)
    
    return result.stdout, result.stderr

command = "whoami"
stdout, stderr = execute(command)

print("Output:", stdout)
print("Error:", stderr)

import os
import subprocess

def execute(command):
    """Secure function that fixes the vulnerability."""
    # SECURE: This version prevents command injection
    env = {
        'PATH': '/usr/bin:/bin',
        'HOME': os.path.expanduser('~')
    }
    
    result = subprocess.run(command, shell=True, env=env, capture_output=True, text=True)
    
    return result.stdout, result.stderr

command = "whoami"
stdout, stderr = execute(command)

print("Output:", stdout)
print("Error:", stderr)

@misc{vaitp:cve202232552,
  title        = {{Privilege escalation via Python environment variables in Pure Storage FlashArray and FlashBlade products}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2022},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2022-32552},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2022-32552/}}
}