CVE-2024-0003: Purestorage Purity//fa Privilege Escalation

CVE-2024-0003 Overview

CVE-2024-0003 affects Pure Storage FlashArray Purity (Purity//FA). A malicious actor with high privileges can abuse a remote administrative service to create a new account on the array with privileged access. The flaw maps to [CWE-269: Improper Privilege Management] and enables persistent, privileged footholds on affected storage systems. Successful exploitation impacts confidentiality, integrity, and availability of data stored on the array.

Critical Impact
An authenticated attacker can create a privileged account on the FlashArray, establishing durable administrative access to enterprise storage and the data it hosts.

Affected Products

Pure Storage Purity//FA (multiple versions)
Pure Storage Purity//FA 6.5.0
FlashArray systems running vulnerable Purity//FA releases

Discovery Timeline

2024-09-23 - CVE-2024-0003 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0003

Vulnerability Analysis

The vulnerability resides in a remote administrative service exposed by FlashArray Purity. The service permits account creation operations that grant privileged access on the array. An attacker who already holds high privileges on the administrative interface can leverage the service to provision a new privileged account outside expected administrative workflows. The result is unauthorized privilege escalation and account persistence within the storage platform.

Because Purity//FA underpins enterprise block and file storage, a rogue privileged account can read, alter, or destroy hosted volumes and snapshots. The attacker can also disable safeguards, exfiltrate data, or stage ransomware operations that target primary and backup datasets stored on the array.

Root Cause

The root cause is improper privilege management on a remote administrative service. The service does not adequately restrict who can invoke account creation with privileged roles. The design allows an authenticated caller to escalate by minting a new account rather than enforcing least privilege on the administrative API surface.

Attack Vector

Exploitation occurs over the network against the FlashArray administrative service. The attacker must already possess high privileges on the target, and no user interaction is required. Once authenticated, the attacker invokes the vulnerable administrative function to create a privileged account, then authenticates as that account to retain access even if the original credentials are revoked.

// No public proof-of-concept code is available.
// See the Pure Storage security advisory for technical details.

Detection Methods for CVE-2024-0003

Indicators of Compromise

Unexpected new administrative or privileged accounts on FlashArray Purity systems.
Account creation events originating from unusual source IPs or outside change windows.
Login activity from newly created accounts immediately after provisioning.
Modifications to role assignments or authentication settings on the array.

Detection Strategies

Forward FlashArray Purity audit logs to a central SIEM and alert on user create or role-assignment events.
Correlate administrative API activity with authorized change tickets to surface out-of-band account provisioning.
Baseline the expected set of privileged accounts and alert on any deviation.

Monitoring Recommendations

Monitor the Purity management network interfaces for authentication anomalies and rate spikes on administrative endpoints.
Track privileged session activity, including snapshot deletions, volume exports, and replication changes.
Review outbound traffic from management hosts that hold FlashArray credentials for signs of credential theft.

How to Mitigate CVE-2024-0003

Immediate Actions Required

Contact Pure Storage support and apply the fixed Purity//FA release identified in the vendor advisory.
Audit all FlashArray accounts and remove any unrecognized privileged users.
Rotate credentials and API tokens for existing administrative accounts on affected arrays.
Restrict management-plane network access to a hardened administrative subnet.

Patch Information

Pure Storage publishes fixed Purity//FA versions and remediation guidance through its security portal. Refer to the Pure Storage Security Information page to identify the appropriate fixed release for each array and to obtain upgrade instructions.

Workarounds

Limit administrative service exposure using network access control lists that permit only trusted management hosts.
Enforce multi-factor authentication and least-privilege role assignments for all Purity administrators.
Disable or restrict unused remote administrative services on the array.
Increase audit logging verbosity and forward events to a monitored log platform until patches are applied.

bash

# Example: restrict management access at the network boundary
# Replace 10.10.20.0/24 with your dedicated admin subnet
iptables -A INPUT -p tcp -s 10.10.20.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP