CVE-2021-32508 : Security Advisory and Response

A Absolute Path Traversal vulnerability in FileStreaming in QSAN Storage Manager allows remote authenticated attackers access arbitrary files by injecting the Symbolic Link following the Url path parameter. The referred vulnerability has been solved with the updated version of QSAN Storage Manager v3.3.3.

Understanding CVE-2021-32508

This CVE-2021-32508 pertains to an Absolute Path Traversal vulnerability in QSAN Storage Manager, affecting versions up to 3.3.1. The vulnerability allows remote authenticated attackers to access arbitrary files.

What is CVE-2021-32508?

The CVE-2021-32508 relates to a UNIX Symbolic Link (Symlink) Following vulnerability in QSAN Storage Manager via FileStreaming function. Attackers can exploit this flaw to access unauthorized files on the system.

The Impact of CVE-2021-32508

The impact of this vulnerability is rated as MEDIUM severity based on the CVSS v3.1 score of 6.5. It poses a high confidentiality impact, allowing attackers to view sensitive information.

Technical Details of CVE-2021-32508

This section provides insights into the vulnerability description, affected systems and versions, and the exploitation mechanism.

Vulnerability Description

The vulnerability allows remote authenticated attackers to access arbitrary files by injecting the Symbolic Link following the Url path parameter in QSAN Storage Manager.

Affected Systems and Versions

QSAN Storage Manager versions less than or equal to 3.3.1 are impacted by this vulnerability.

Exploitation Mechanism

Attackers can exploit this vulnerability by injecting a Symbolic Link in the Url path parameter through the FileStreaming function.

Mitigation and Prevention

Understand the key steps to minimize the risk posed by CVE-2021-32508 and secure your systems.

Immediate Steps to Take

Update QSAN Storage Manager to version 3.3.3 to mitigate the vulnerability.
Monitor and restrict user access to critical files and directories.

Long-Term Security Practices

Regularly patch and update software to address known vulnerabilities.
Implement network segmentation to limit the impact of potential breaches.

Patching and Updates

Stay informed about security updates from QSAN and promptly apply patches to ensure system security.