CVE-2024-0005 Overview
CVE-2024-0005 is a command injection vulnerability affecting Pure Storage FlashArray and FlashBlade Purity operating environments. An authenticated attacker can execute arbitrary commands remotely by supplying a specifically crafted Simple Network Management Protocol (SNMP) configuration. The flaw is tracked under CWE-77: Improper Neutralization of Special Elements used in a Command and impacts confidentiality, integrity, and availability of the affected storage appliances.
Critical Impact
A low-privileged network attacker can achieve arbitrary command execution on FlashArray and FlashBlade storage controllers, threatening the integrity of enterprise data stores.
Affected Products
- Pure Storage Purity//FA (including versions 6.5.0 and 6.6.0)
- Pure Storage Purity//FB (including versions 4.3.0 and 4.3.1)
- Earlier Purity//FA and Purity//FB releases within the affected ranges
Discovery Timeline
- 2024-09-23 - CVE-2024-0005 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0005
Vulnerability Analysis
The vulnerability resides in how Purity processes SNMP configuration input on FlashArray and FlashBlade systems. Attacker-controlled fields within an SNMP configuration are passed to an underlying command interpreter without adequate neutralization of shell metacharacters. This allows a malicious operator to break out of the intended command context and execute arbitrary operating system commands on the storage controller.
Exploitation requires network access to the management plane and low-level privileges on the appliance. Successful exploitation grants command execution in the security context of the Purity management process. Because storage controllers mediate access to enterprise data volumes and object stores, arbitrary command execution here can lead to data disclosure, tampering with stored blocks or objects, and disruption of storage services.
Root Cause
The root cause is improper neutralization of special elements passed to an OS command (CWE-77). SNMP configuration parameters are concatenated into shell command strings without sufficient input validation or safe argument handling. Well-formed but malicious values escape the intended parameter boundary and are interpreted by the shell as additional commands.
Attack Vector
The attack vector is network-based against the Purity management interface. An authenticated user with permission to modify SNMP settings submits a crafted configuration payload containing shell metacharacters or chained command sequences. The Purity subsystem processes the configuration and executes the injected commands on the controller. No user interaction is required to trigger execution once the malicious configuration is applied.
Verified proof-of-concept code is not publicly available. Refer to the Pure Storage Security Advisories for vendor-provided technical details.
Detection Methods for CVE-2024-0005
Indicators of Compromise
- Unexpected changes to SNMP community strings, trap destinations, or user configuration on Purity systems
- Purity audit log entries showing SNMP configuration modifications from unusual source addresses or accounts
- Outbound connections from FlashArray or FlashBlade controllers to unknown hosts following administrative activity
- Unexplained new processes, cron entries, or shell activity spawned from the SNMP subsystem
Detection Strategies
- Enable and centrally collect Purity audit logs, then alert on any SNMP configuration change events
- Correlate SNMP configuration writes with subsequent outbound network activity from the storage array management interfaces
- Baseline expected SNMP configuration values and flag any deviation containing shell metacharacters such as ;, |, `, $(, or &&
- Restrict administrative API and SSH access to the storage arrays and monitor authentication events for anomalous sources
Monitoring Recommendations
- Forward Purity syslog and audit streams into a centralized SIEM or data lake for retention and analytics
- Monitor privileged account activity on FlashArray and FlashBlade with alerts on off-hours or first-seen source IP addresses
- Track network flows between administrator workstations and storage management interfaces to identify unauthorized SNMP configuration sessions
How to Mitigate CVE-2024-0005
Immediate Actions Required
- Contact Pure Storage support and apply the fixed Purity//FA and Purity//FB releases identified in the vendor advisory
- Rotate SNMP community strings and any administrative credentials that may have been exposed on affected arrays
- Review Purity audit logs for suspicious SNMP configuration changes since deployment of the affected versions
- Restrict management-plane network access to a dedicated administrative VLAN with strict access control lists
Patch Information
Pure Storage has published remediation guidance on the Pure Storage Security Advisories portal. Customers should engage Pure Storage support to identify the appropriate Purity//FA or Purity//FB target release for their platform and schedule an upgrade.
Workarounds
- Limit SNMP configuration privileges to a minimal set of trusted administrators until patching is complete
- Disable SNMP write access on affected arrays if it is not required for operations
- Enforce network segmentation so only authorized management hosts can reach the Purity management interfaces
- Require multi-factor authentication for administrative access to storage management consoles where supported
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
