PT-2023-7927 · Hitachi Vantara · Hitachi Vantara Hnas

Arslan Masood · Published 2023-12-04 · Updated 2024-03-12 · CVE-2023-5808

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Hitachi Vantara HNAS versions prior to 14.8.7825.01

Description The issue allows authenticated users to access sensitive information through Insecure Direct Object Reference (IDOR). This can be achieved by manipulating URLs, enabling users in certain administrative roles to download confidential files, including HNAS configuration backup and diagnostic data, that would normally be restricted from their role. The vulnerability is related to authorization procedure weaknesses, potentially allowing remote attackers to gain unauthorized access to protected information.

Recommendations For versions prior to 14.8.7825.01, consider restricting access to sensitive files and diagnostic data until a patch is available. As a temporary workaround, limit URL manipulation capabilities for authenticated users in Storage, Server, or combined Server+Storage administrative roles to minimize the risk of exploitation. Avoid using URL manipulation to access HNAS configuration backup and diagnostic data in affected versions. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Privilege Assignment

Improper Authorization

Improper Authentication

Weakness Enumeration

CWE-266

CWE-285

CWE-287

Related Identifiers

BDU:2023-09005

CVE-2023-5808

Affected Products

Hitachi Vantara Hnas

References · 13

• https://bdu.fstec.ru/vul/2023-09005 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-5808 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5808 · Vendor Advisory
• https://twitter.com/arszilla/status/1734570132238680556 · Twitter Post
• https://t.me/cvenotify/63180 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1731851204672495941 · Twitter Post
• https://twitter.com/CVEnew/status/1731842509276692813 · Twitter Post
• https://t.me/cybersecuritytechnologies/10134 · Telegram Post
• https://twitter.com/ksg93rd/status/1767399021297967127 · Twitter Post
• https://t.me/cvenotify/63015 · Telegram Post
• https://t.me/cvenotify/62841 · Telegram Post
• https://vuldb.com/ru/?id.246863 · Note
• https://knowledge.hitachivantara.com/Security/System_Management_Unit_(SMU)_versions_prior_to_14.8.7825.01%2C_used_to_manage_Hitachi_Vantara_NAS_products_are_susceptible_to_unintended_information_disclosure_via_unprivileged_access_to_HNAS_configuration_backup_and_diagnostic_data. · Note