CVE-2024-0004: Purestorage Purity//fa RCE Vulnerability

CVE-2024-0004 Overview

CVE-2024-0004 is a privilege escalation vulnerability in Pure Storage FlashArray Purity (purity//fa). An authenticated user holding the array admin role can execute arbitrary commands remotely against the array and escalate privileges beyond the administrative scope. The weakness is classified under CWE-94: Improper Control of Generation of Code, commonly referred to as code injection. The flaw affects multiple releases of Purity//FA up to and including version 6.5.0. Exploitation requires network access to the management interface and valid high-privilege credentials, but it enables full compromise of the storage array once those prerequisites are met.

Critical Impact
An array admin can pivot from application-level administration to arbitrary command execution on the underlying array, resulting in complete loss of confidentiality, integrity, and availability of stored data.

Affected Products

Pure Storage Purity//FA versions up to and including 6.5.0
FlashArray systems running vulnerable Purity//FA releases
Deployments exposing the Purity management plane to administrative users

Discovery Timeline

2024-09-23 - CVE-2024-0004 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0004

Vulnerability Analysis

CVE-2024-0004 is a code injection flaw in the Purity//FA management surface. A user assigned the array admin role can supply crafted input to a management function that passes attacker-controlled content into a command interpreter without adequate validation or sandboxing. The result is arbitrary command execution in a context that exceeds the intended boundary of the array admin role.

The attack vector is the network, and the attack complexity is low. High privileges are required, which limits the pool of potential attackers to users who already hold administrative credentials or accounts that have been compromised. Once triggered, the vulnerability yields high impact to confidentiality, integrity, and availability. All data blocks, snapshots, replication targets, and configuration state managed by the array are within reach of the escalated process.

The EPSS (Exploit Prediction Scoring System) probability for CVE-2024-0004 is 0.642% at the 47.8 percentile. No public proof-of-concept, exploit database entry, or in-the-wild exploitation has been reported at the time of NVD publication.

Root Cause

The root cause is improper control over the generation of code or commands executed by the Purity//FA management layer [CWE-94]. Administrative operations accept input that is incorporated into a command or interpreter invocation without sufficient neutralization. This allows a privileged user to break out of the intended command structure and execute operating system commands on the array.

Attack Vector

An authenticated array admin submits crafted parameters to a vulnerable Purity//FA management endpoint. The malicious payload is embedded in a value that Purity passes to an underlying command execution path. The interpreter executes both the intended action and the attacker-supplied commands, yielding privilege escalation to the array runtime. Because the vector is network-based, the attacker only needs reachability to the Purity management interface and valid array admin credentials. See the Pure Storage Security Resource for vendor guidance.

Detection Methods for CVE-2024-0004

Indicators of Compromise

Unexpected shell processes or utilities (for example, sh, bash, curl, wget, nc) spawned by Purity management processes
Administrative API calls containing shell metacharacters such as ;, |, &&, backticks, or $() in parameter values
New or modified files in system directories on the array outside of a planned upgrade window
Outbound network connections from the array to non-standard destinations following administrative sessions

Detection Strategies

Audit Purity//FA management API and CLI logs for administrative commands with anomalous argument content
Correlate array admin authentication events with subsequent command execution to identify sessions that deviate from operator baselines
Alert on privileged sessions that originate from unexpected source IP ranges or outside normal maintenance windows

Monitoring Recommendations

Forward Purity audit logs and syslog to a centralized SIEM or data lake for retention and correlation
Track the population of accounts holding the array admin role and monitor for unauthorized additions
Baseline outbound network traffic from FlashArray management interfaces and alert on deviations

How to Mitigate CVE-2024-0004

Immediate Actions Required

Apply the Purity//FA update referenced in the Pure Storage Security Resource as soon as it is available for your release train
Rotate credentials for all accounts assigned the array admin role and enforce multi-factor authentication on the management plane
Restrict network access to the Purity management interface to a dedicated administrative network or bastion
Review recent array admin activity for evidence of command injection attempts

Patch Information

Pure Storage tracks fixed versions and remediation guidance through the Pure Storage Security Resource. Administrators should consult the vendor advisory for the specific Purity//FA build that resolves CVE-2024-0004 and follow the documented upgrade procedure for their FlashArray platform.

Workarounds

Reduce the number of accounts assigned the array admin role to the minimum required for operations
Isolate the Purity management network from general corporate and user networks using firewall rules or VLAN segmentation
Require jump-host access with session recording for all administrative sessions to FlashArray systems
Monitor administrative API calls for shell metacharacters and block or alert on suspicious parameter content at an upstream proxy

bash

# Configuration example: restrict management access with host-level firewall rules
# Allow only the administrative bastion subnet to reach the Purity management interface
iptables -A INPUT -p tcp --dport 443 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP