CVE-2026-55721: Storage Concentrator SQLi Vulnerability

CVE-2026-55721 Overview

CVE-2026-55721 is a SQL injection vulnerability affecting StoneFly Storage Concentrator (SC) and Storage Concentrator Virtual Machine (SCVM). The flaw resides in the login.pl and debug.pl scripts, which incorporate cookie values directly into database queries without adequate sanitization. An unauthenticated remote attacker can manipulate these queries to extract session tokens, password hashes, and stored secret keys from the underlying database. The vulnerability is tracked under CWE-89 and was published in CISA ICS Advisory ICSA-26-181-06.

Critical Impact
Unauthenticated remote attackers can extract session tokens, password hashes, and secret keys from the Storage Concentrator database via crafted cookie values.

Affected Products

StoneFly Storage Concentrator (SC)
StoneFly Storage Concentrator Virtual Machine (SCVM)
Web management interface scripts login.pl and debug.pl

Discovery Timeline

2026-06-30 - CVE-2026-55721 published to NVD
2026-07-01 - Last updated in NVD database

Technical Details for CVE-2026-55721

Vulnerability Analysis

The vulnerability exists in the authentication and debug workflow of StoneFly Storage Concentrator. The Perl scripts login.pl and debug.pl read HTTP cookie values submitted by clients and concatenate them into SQL statements executed against the backend database. Because no parameterization or input sanitization is applied, an attacker can inject arbitrary SQL syntax through cookie headers.

The injection point is reachable pre-authentication, since cookies are processed during the login flow itself. Successful exploitation allows database record enumeration and extraction of authentication material. Compromised session tokens or password hashes enable follow-on authenticated access to storage management functions.

Root Cause

The root cause is improper neutralization of special elements in SQL commands [CWE-89]. Cookie values are trusted as safe input and interpolated directly into query strings. The affected scripts do not use prepared statements, bind parameters, or an allow-list validation routine before query construction.

Attack Vector

Exploitation requires only network access to the Storage Concentrator management interface. The attacker crafts an HTTP request to login.pl or debug.pl containing a malicious Cookie header. Payloads use standard SQL injection techniques such as union-based extraction, boolean-based blind inference, or time-based blind inference to enumerate database contents.

Targets of interest include session token tables, user credential tables containing password hashes, and configuration tables holding secret keys used for storage encryption or replication. See the CISA advisory for full technical details.

Detection Methods for CVE-2026-55721

Indicators of Compromise

HTTP requests to /login.pl or /debug.pl containing SQL metacharacters such as single quotes, UNION SELECT, --, or /* in the Cookie header.
Web server access logs showing repeated requests to authentication endpoints from a single source with varying cookie payloads.
Database error messages or unusually long response times from the Storage Concentrator management interface, suggesting blind injection probing.
Unexpected outbound traffic or new administrative sessions originating from the Storage Concentrator following suspicious login activity.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect Cookie header values for SQL injection patterns before requests reach the Storage Concentrator.
Enable verbose logging on the Storage Concentrator web server and forward logs to a centralized platform for correlation of anomalous cookie payloads.
Correlate authentication failures on login.pl with subsequent successful logins to detect credential material extracted via injection.

Monitoring Recommendations

Baseline normal cookie header structure for the Storage Concentrator and alert on deviations in length, character classes, or SQL keywords.
Monitor database query logs (if available on SCVM) for unusual query shapes originating from the web application user.
Track administrative access to the management interface and alert on logins outside expected source ranges or maintenance windows.

How to Mitigate CVE-2026-55721

Immediate Actions Required

Restrict network access to the Storage Concentrator management interface using firewall rules or a management VLAN, allowing only trusted administrative hosts.
Contact StoneFly through the Stonefly Contact Page to obtain the fixed firmware or patch for SC and SCVM.
Rotate all session tokens, administrative passwords, and stored secret keys under the assumption that they may have been extracted.
Review web server and database logs for prior exploitation attempts against login.pl and debug.pl.

Patch Information

StoneFly has been notified through the CISA coordinated disclosure process documented in ICSA-26-181-06. Refer to the vendor advisory and the CSAF document for the current patched version. Apply the vendor-supplied update to all SC and SCVM instances.

Workarounds

Place the Storage Concentrator management interface behind a reverse proxy or WAF that strips or validates cookie headers before forwarding requests.
Disable external access to debug.pl at the web server layer if the endpoint is not required for normal operation.
Enforce IP allow-listing on the management interface so that only known administrator workstations can reach login.pl.

bash

# Example nginx rule to block SQL metacharacters in Cookie headers
location ~ ^/(login|debug)\.pl$ {
    if ($http_cookie ~* "(union|select|--|/\*|';)") {
        return 403;
    }
    allow 10.0.0.0/24;   # management subnet
    deny all;
    proxy_pass http://storage_concentrator_backend;
}