Command Injection in Brocade Fabric OS

Executive Summary

This is an OS command injection vulnerability in Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. During configuration download operations, the management daemon passes user-supplied relay host strings and filenames to an internal script without proper validation. The script then fails to sanitize shell metacharacters before executing system commands, allowing arbitrary OS commands to run on a remote switch when an administrator initiates a configuration download.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves OS command injection during configuration download operations in Brocade Fabric OS. To detect it, check for unauthorized command execution during config downloads or inspect logs for suspicious relay host strings or filenames containing shell metacharacters. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary commands on affected switches, potentially leading to unauthorized access, data theft, or disruption of network operations. Administrators initiating configuration downloads may unknowingly trigger malicious commands if a compromised configuration file is present.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance penalties if exploited, as it undermines secure system management and data protection controls.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Brocade Fabric OS to version 9.2.2d or later, or 10.0.0a2 or later. Avoid using configuration download operations until patched. Review and sanitize configuration files for malicious content before use.

Useful 0 Not Useful 0