CVE-2022-31231: Dell ECS Information Disclosure Flaw

CVE-2022-31231 Overview

CVE-2022-31231 is an improper access control vulnerability [CWE-284] in the Identity and Access Management (IAM) module of Dell Elastic Cloud Storage (ECS) versions 3.5 and 3.6. A remote unauthenticated attacker can exploit this flaw over the network to gain read access to unauthorized data. The vulnerability requires no privileges and no user interaction, making it exploitable directly against exposed ECS endpoints. Dell ECS is an object storage platform deployed in enterprise and service provider environments, often holding large volumes of unstructured data. Exposure of IAM-controlled resources undermines the confidentiality boundary that ECS tenants and administrators rely on.

Critical Impact
A remote, unauthenticated attacker can read data that should be protected by the ECS IAM authorization layer, exposing tenant or system data stored in affected ECS clusters.

Affected Products

Dell Elastic Cloud Storage (ECS) version 3.5
Dell Elastic Cloud Storage (ECS) version 3.6
Dell ECS IAM module (Identity and Access Management component)

Discovery Timeline

2026-05-22 - CVE-2022-31231 published to NVD
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2022-31231

Vulnerability Analysis

The flaw resides in the IAM module of Dell ECS, which governs authentication and authorization for object storage operations. The IAM module fails to enforce access controls correctly for certain requests, allowing unauthenticated callers to retrieve data they should not be able to read. Because the issue is in the access control logic rather than a credential validation routine, attackers do not need to forge tokens or replay sessions. The impact is limited to confidentiality, with no integrity or availability consequences reported by Dell. The vulnerability is reachable over the network through standard ECS service interfaces, which are commonly exposed to internal applications and, in some deployments, to external consumers.

Root Cause

The root cause is improper access control [CWE-284] in the IAM module. Authorization checks for specific resource paths or API operations are either missing or incorrectly evaluated, so the module returns protected data to callers that have not been authenticated or authorized. This is a logic-level failure in the policy enforcement layer, not a memory safety or injection issue.

Attack Vector

The attack vector is network-based. An attacker sends crafted requests to an ECS endpoint that routes through the vulnerable IAM module. No credentials, prior access, or user interaction are required. Successful exploitation returns data that should be gated behind IAM policy. Refer to the Dell Services Knowledge Base Article for vendor-supplied technical details and remediation guidance.

Detection Methods for CVE-2022-31231

Indicators of Compromise

Unauthenticated HTTP/HTTPS requests to ECS IAM and object endpoints that return 200 OK with response bodies instead of 401 or 403.
Spikes in GET requests from external or unexpected internal sources targeting ECS management or data APIs.
Access log entries showing requests without valid Authorization headers receiving data payloads.

Detection Strategies

Review ECS access and audit logs for requests to IAM-protected resources that succeeded without an authenticated principal.
Compare ECS request patterns against expected client inventories and flag traffic from unknown IP ranges or service accounts.
Monitor for enumeration behavior such as sequential listing requests against IAM, bucket, or user resources.

Monitoring Recommendations

Forward ECS access logs and IAM audit events to a centralized SIEM for correlation with network telemetry.
Alert on anonymous or null-principal accesses to any ECS API surface and treat them as high-priority events until the cluster is patched.
Track outbound data volumes from ECS nodes to detect bulk read activity consistent with unauthorized data retrieval.

How to Mitigate CVE-2022-31231

Immediate Actions Required

Identify all Dell ECS clusters running versions 3.5 or 3.6 and inventory their network exposure.
Apply the fixed ECS release referenced in the Dell advisory as soon as change windows allow.
Restrict network access to ECS management and IAM endpoints to known administrative networks until patching completes.
Rotate any credentials or tokens that may have been retrievable through the affected IAM paths.

Patch Information

Dell has published remediation guidance in the Dell Services Knowledge Base Article for CVE-2022-31231. Administrators should upgrade Dell ECS 3.5 and 3.6 deployments to the fixed version specified by Dell. Validate the upgrade by confirming that unauthenticated requests to IAM-protected endpoints return authentication errors rather than data.

Workarounds

Place ECS IAM and API endpoints behind network access control lists that permit only trusted client subnets.
Terminate ECS traffic through a reverse proxy or API gateway that enforces authentication before requests reach the IAM module.
Disable or block external exposure of ECS management interfaces until the patched version is deployed.

bash

# Configuration example: restrict ECS API exposure with host firewall rules
# Allow only trusted management subnet to reach ECS API ports
iptables -A INPUT -p tcp -s 10.10.0.0/24 --dport 4443 -j ACCEPT
iptables -A INPUT -p tcp -s 10.10.0.0/24 --dport 9021 -j ACCEPT
iptables -A INPUT -p tcp --dport 4443 -j DROP
iptables -A INPUT -p tcp --dport 9021 -j DROP