Pure Storage FlashArray Purity API endpoint: A specific call to a FlashArray endpoint escalates the caller's privileges

Impact

A specific call to a FlashArray endpoint escalates the caller's privileges on the array, which puts every volume, snapshot and host mapping under attacker control.

Who can reach it

Network access to the FlashArray management endpoint. The CVSS vector records no privileges required, so treat any route to the management interface as sufficient.

What to do

Upgrade Purity//FA to the fixed release Pure names in its security bulletin. Confirm the array's management interface is not reachable from tenant or compute networks, and audit recently created accounts and host mappings.

References