Numerous vulnerabilities related to SQL injection, cross-site scripting (XSS), privilege escalation, command injection, and path tracing have been found in Dell’s PowerProtect. These vulnerabilities have a severity score of 4.3 (Medium) to 8.8 (High).

All of the Dell PowerProtect vulnerabilities have relevant CVEs assigned to them, with CVE-2023-44286 related to Cross-Site Scripting having the highest severity (8.8) and CVE-2023-44284 having the lowest severity (4.3).

Numerous Problems with Dell PowerProtect Items

Four OS command injections, one path traversal, one SQL injection, one cross-site scripting (XSS), and one privilege escalation are among the nearly eight vulnerabilities that have been made public. Versions of Dell PowerProtect DD before 7.13.0.10, LTS 7.7.5.5, LTS 7.10.1.15, and 6.2.1.1110 are affected by these vulnerabilities.

OS Command Injection

CVE-2023-48668 (8.8), CVE-2023-44277 (7.8), CVE-2023-48667 (7.2), and CVE-2023-44279 (6.7) were all related to a vulnerability in OS command injection that could allow a threat actor to potentially circumvent security measures or execute arbitrary OS commands. 

Some of these vulnerabilities might also be exploited by a threat actor, who could then use them to carry out a variety of actions, including controlling the system and running OS commands with unauthorized application privileges, among many other things.

The Path Traversal vulnerability, identified as CVE-2023-44278, allows threat actors to read and write to OS files kept on the server filesystem without authorization. This vulnerability has a severity of 6.7 (Medium).

The SQL injection vulnerability CVE-2023-44284 can be used by a threat actor to run SQL commands on the application’s backend database, granting them unauthorized access to read application data. This vulnerability has been assigned a 4.3 (Low) severity.

The vulnerability known as Cross-Site Scripting (XSS) CVE-2023-44286 pertains to the ability of a threat actor to execute Javascript code within the Document Object Model (DOM) environment of the victim’s browser. 

Information disclosure, session theft, or client-side request forgery could result from successful exploitation. This vulnerability has an 8.8 (High) severity rating.

A vulnerability known as Privilege Escalation (CVE-2023-44285) allows a threat actor with low privilege to escalate their privilege as a result of insufficient access control. This vulnerability has been rated as 7.8 (High) in terms of severity.

Moreover, comprehensive details regarding these vulnerabilities, their CVSS vector, and other information are available in the Dell security advisory.

Dell Encourages Users to Fix PowerProtect Product Vulnerabilities

Customers who have purchased PowerProtect products from Dell are being urged to read a recently released security advisory and apply patches for several potentially dangerous vulnerabilities.

These vulnerabilities affect appliances in the PowerProtect Data Domain (DD) series, which are intended to assist enterprises in managing, recovering, and safeguarding large amounts of data. Affected appliances also include APEX Protect Storage, PowerProtect DD Management Centre, PowerProtect DP series appliances, and PowerProtect Data Manager appliances.

With a DOM-based cross-site scripting (XSS) vulnerability that lets an unauthenticated remote attacker insert malicious code into the targeted user’s browser, CVE-2023-44286 is the most dangerous of the flaws, with a CVSS score of 8.8. 

Information disclosure, session theft, and client-side request forgery could result from exploitation. Although Dell’s advisory doesn’t say so, taking advantage of these kinds of vulnerabilities usually entails tricking the target into clicking on a malicious link.  

Several other vulnerabilities, such as improper access control and OS command injection, have been rated as “high severity.” 

An attacker may be able to take control of the targeted system by using the command injection bugs to execute arbitrary commands on the underlying operating system with the privileges of vulnerable exploitation. 

Either low or elevated privileges and local access are necessary for exploitation. It is plausible, nevertheless, that an attacker could be able to fulfill the authentication requirement by taking advantage of a vulnerability like CVE-2023-44286.

An authorized attacker can circumvent security measures and take control of the system by using the three medium-severity vulnerabilities in PowerProtect products. They can also be used to execute arbitrary SQL commands on the application’s backend database and obtain read access to app data. 

Remedies for vulnerabilities affecting specific Dell PowerProtect Data Domain products have been made available by Dell Technologies. For impacted products, versions, and more, we urge customers to read over and follow the remediation instructions in the Dell Security Advisory (DSA-2023-412). One of our top priorities is keeping our products secure.

According to the company, it promptly fixed the vulnerability and is not currently aware of any active exploitation. 

It’s important to note that sophisticated threat actors have been known to use vulnerabilities in Dell products as a means of attack. 

Additionally, Dell recently notified customers about numerous vulnerabilities affecting PowerMax and Unisphere products, dozens of vulnerabilities affecting third-party components of VxRail Manager, and a high-severity privilege escalation vulnerability in the BIOS of PowerEdge Servers.