CVE-2024-21985 Overview
CVE-2024-21985 affects NetApp ONTAP 9, a data management operating system for enterprise storage systems. The vulnerability allows an authenticated user holding multiple remote accounts with differing roles to perform REST API actions beyond their intended privilege. Attackers can view limited configuration details and metrics or modify limited settings. Some of these modifications can trigger a Denial of Service (DoS) condition. NetApp assigned the flaw to CWE-269: Improper Privilege Management. The vulnerability affects ONTAP 9 releases prior to 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10, and 9.13.1P4.
Critical Impact
Authenticated users can escalate privileges through the ONTAP REST API and induce a Denial of Service against storage services.
Affected Products
- NetApp ONTAP 9 versions prior to 9.9.1P18
- NetApp ONTAP 9 versions prior to 9.10.1P16, 9.11.1P13, and 9.12.1P10
- NetApp ONTAP 9 versions prior to 9.13.1P4
Discovery Timeline
- 2024-01-26 - CVE-2024-21985 published to NVD alongside NetApp Security Advisory NTAP-20240126-0001
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-21985
Vulnerability Analysis
The vulnerability resides in the ONTAP REST API authorization layer. When a single user identity is bound to multiple remote accounts with differing roles, the API fails to consistently enforce the least-privileged role for each request. The result is a privilege boundary violation classified under CWE-269. An authenticated caller can invoke API endpoints that should be reserved for higher-privileged roles.
The abuse produces two distinct outcomes. First, the attacker gains read access to configuration data and system metrics outside their assigned scope. Second, the attacker can modify a limited set of settings. Certain modifications degrade or interrupt service, producing a Denial of Service against the storage cluster.
Root Cause
The root cause is improper role resolution when a user maps to more than one remote account. The API evaluates permission using role state that does not correspond to the account context of the current request. This inconsistency lets a lower-privileged role inherit actions permitted by a higher-privileged role.
Attack Vector
The attack is network-based and requires an authenticated account on the ONTAP cluster. The attacker must possess multiple remote accounts with different roles assigned to the same identity. Exploitation is performed by issuing crafted REST API calls to endpoints normally gated by the higher role. No user interaction is required. See the NetApp Security Advisory NTAP-20240126-0001 for vendor technical details.
Detection Methods for CVE-2024-21985
Indicators of Compromise
- REST API requests to /api/ endpoints from accounts whose assigned role does not normally permit the requested operation.
- Configuration or setting changes originating from accounts with read-only or limited administrative roles.
- Unexpected DoS conditions or service disruptions correlated with recent REST API write operations.
Detection Strategies
- Audit ONTAP security audit logs for REST API calls that return success codes on endpoints outside the caller's documented role scope.
- Correlate authentication events for identities holding multiple remote accounts and flag cross-role API activity.
- Baseline normal REST API usage per account and alert on deviations, particularly write or modify operations.
Monitoring Recommendations
- Forward ONTAP audit logs and REST API telemetry to a centralized SIEM or data lake for retention and correlation.
- Alert on repeated privilege-sensitive API calls from the same identity across multiple remote account contexts.
- Monitor cluster health metrics for DoS indicators that align in time with administrative API activity.
How to Mitigate CVE-2024-21985
Immediate Actions Required
- Upgrade ONTAP 9 to a fixed release: 9.9.1P18, 9.10.1P16, 9.11.1P13, 9.12.1P10, or 9.13.1P4 or later.
- Inventory all user identities that map to multiple remote accounts and review the roles assigned to each.
- Restrict REST API access at the network layer to trusted management subnets until patches are applied.
Patch Information
NetApp released fixed builds for each affected train. Refer to the vendor advisory NTAP-20240126-0001 for the authoritative patch matrix and download locations. Apply the corresponding P-release for your active ONTAP 9 branch.
Workarounds
- Consolidate each user identity to a single remote account with a single role where operationally feasible.
- Remove redundant remote account mappings that grant differing privilege levels to the same principal.
- Enforce role-based access reviews for all cluster administrators and service accounts using the REST API.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
