Brocade SANnav Management Portal - Zone management endpoints, before SANnav 2.2.0: SQL injection in multiple endpoints

Impact

SQL injection in multiple endpoints associated with zone management, allowing arbitrary SQL against the SANnav database. SANnav is the single management plane for an entire Fibre Channel estate; its database holds the fabric inventory, the zoning configuration and the stored switch credentials. Arbitrary SQL there means reading every switch password SANnav holds and manipulating the zoning configuration it pushes - so one flaw in a management appliance converts into cross-tenant LUN exposure across every fabric it manages, without ever touching a switch directly.

Who can reach it

A user who can reach the SANnav web application. The zone-management endpoints sit behind the portal login, so realistically this is a low-privilege operator account, a stolen session, or an attacker who first used one of the SANnav authentication-bypass defects.

What to do

Upgrade the SANnav Management Portal to 2.2.0 or later. This is an appliance/VM upgrade, not a switch firmware flash - no fabric downtime and no arrays offline, but it does take the management plane out for the duration. Afterwards, rotate every switch credential stored in SANnav, because the point of the bug is that they were readable. Keep SANnav off any network a tenant or a BMC can reach.

References