Vulnerability in SoftNAS Cloud allows attackers to bypass authentication

guest · Mar 20, 2019

Vulnerability in SoftNAS Cloud allows attackers to bypass authentication
March 20, 2019
https://www.techrepublic.com/articl...ud-allows-attackers-to-bypass-authentication/

A vulnerability in SoftNAS Cloud allows attackers to completely bypass authentication when attempting to access the web-based admin interface, according to a Wednesday report from Digital Defense.

The vulnerability can be exploited "if customers have not followed SoftNAS deployment best practices and have openly exposed SoftNAS StorageCenter ports directly to the internet," which seems obvious on the surface, though the potential for someone to have configured this incorrectly is clearly possible.

This is far from the first time we've seen a vulnerability like this [...] As more companies move to the cloud, both cloud system providers and IT professionals need to ensure systems are configured correctly to ensure sensitive data is protected.
Click to expand...

https://twitter.com/Digital_Defense/status/1108387027198857216

SoftNAS® Vulnerability Disclosed by Digital Defense, Inc. Researchers
March 20, 2019
https://www.prweb.com/releases/soft...tal_defense_inc_researchers/prweb16182890.htm

If customers have not followed SoftNAS deployment best practices and have openly exposed SoftNAS StorageCenter® ports directly to the internet, SoftNAS Cloud Enterprise 4.2.0 is vulnerable to an authenticated bypass that could be leveraged to gain access to the webadmin interface without valid user credentials.

The vulnerability is not present on SoftNAS Cloud versions prior to 4.2 and is fixed in versions 4.2.2 and later.
Click to expand...

Log in or Sign up

Vulnerability in SoftNAS Cloud allows attackers to bypass authentication

guest Guest

Log in or Sign up

Vulnerability in SoftNAS Cloud allows attackers to bypass authentication

guest Guest

Useful Searches