Unauthenticated Remote Command Injection in Brocade SANnav

Executive Summary

This is an unauthenticated remote command injection flaw in the Brocade SANnav orchestrator HTTP service. It allows network-adjacent attackers to execute arbitrary administrative switch CLI commands and manage containers without authentication. The issue affects versions before 3.0.1a.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for unauthorized administrative commands or container management activities on Brocade SANnav systems. Inspect HTTP service logs for unusual POST requests or command execution patterns. Verify if SANnav versions are below 3.0.1a using system commands like 'show version' or checking installed packages.

Useful 0 Not Useful 0

Impact Analysis

An attacker could alter Fibre Channel fabric switch configurations or manipulate application container runtimes. This may lead to unauthorized access, data breaches, or disruption of network services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated remote command injection, enabling attackers to execute arbitrary administrative commands on Fibre Channel fabric switches or manipulate container runtimes. Such unauthorized access could lead to unauthorized data access, modification, or deletion, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Brocade SANnav to version 3.0.1a or later. Isolate affected systems from untrusted networks. Review and audit administrative commands and container activities for signs of compromise. Apply network segmentation to limit access to the HTTP service.

Useful 0 Not Useful 0