CVE-2019-9945 : What You Need to Know

SoftNAS Cloud versions 4.2.0 and 4.2.1 have a vulnerability that allows remote command execution through the web interface. This can be exploited by providing an arbitrary value for a user cookie, granting unauthorized access to the platform.

Understanding CVE-2019-9945

SoftNAS Cloud 4.2.0 and 4.2.1 are susceptible to a critical security flaw that enables attackers to execute commands remotely, compromising system integrity and data confidentiality.

What is CVE-2019-9945?

The vulnerability in SoftNAS Cloud versions 4.2.0 and 4.2.1 permits unauthorized users to access the Webadmin interface and perform malicious actions without valid credentials.

The Impact of CVE-2019-9945

Exploiting this vulnerability can lead to unauthorized access to the platform, enabling attackers to create new users, execute arbitrary commands with administrative privileges, and compromise both the system and associated data.

Technical Details of CVE-2019-9945

SoftNAS Cloud 4.2.0 and 4.2.1 are affected by a critical vulnerability that allows remote command execution through the web interface.

Vulnerability Description

The default NGINX configuration file lacks proper validation for user cookies, enabling attackers to bypass authentication mechanisms and gain unauthorized access to the platform.

Affected Systems and Versions

SoftNAS Cloud versions 4.2.0 and 4.2.1

Exploitation Mechanism

Attackers can provide arbitrary values for user cookies to access the web interface without valid credentials.

Mitigation and Prevention

To address CVE-2019-9945, immediate actions and long-term security practices are essential.

Immediate Steps to Take

Ensure SoftNAS Cloud deployments follow recommended security practices.
Restrict direct exposure of SoftNAS StorageCenter ports to the internet.

Long-Term Security Practices

Regularly update and patch SoftNAS Cloud to mitigate known vulnerabilities.
Implement network segmentation to limit access to critical systems.

Patching and Updates

Apply security patches provided by SoftNAS promptly to address CVE-2019-9945.