Security Bulletin: IBM Storage Fusion and IBM Storage Fusion HCI may be vulnerable to an authorization bypass due to emicklei/go-restful [CVE-2022-1996]

Summary

IBM Storage Fusion and IBM Storage Fusion HCI, previously known as Spectrum Fusion and Spectrum Fusion HCI, may be affected by a vulnerability in emicklei/go-restful. The Vulnerability includes an authorization bypass through a user-controlled key as described by the CVE in the “Vulnerability Details” section. IBM has addressed the vulnerabiblity.

Vulnerability Details

CVEID:CVE-2022-1996
**DESCRIPTION:**go-restful could allow a remote attacker to bypass security restrictions, caused by improper regular expression implementation in the CORS Filter feature. By sending a specially-crafted request using the AllowedDomains parameter, an attacker could exploit this vulnerability to break CORS policy and allow any page to make requests.
CVSS Base score: 9.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/228317 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N)

Affected Products and Versions

IBM Storage Fusion 2.5.0, 2.5.1, 2.5.2 and IBM Storage Fusion HCI 2.5.0, 2.5.2 are not affected.

Remediation/Fixes

IBM Storage Fusion:

• Upgrade to IBM Storage Fusion 2.6.1
• Link to Fix: <https://www.ibm.com/support/pages/node/7028202&gt;

IBM Storage Fusion HCI:

• Upgrade to IBM Storage Fusion HCI 2.6.1
• Link to Fix: <https://www.ibm.com/support/pages/node/7028202&gt;

Workarounds and Mitigations

None