Description
BridgeHead FileStore versions prior to 24A (released in early 2024) expose the Apache Axis2 administration module on network-accessible endpoints with default credentials that allows unauthenticated remote attackers to execute arbitrary OS commands. Attackers can authenticate to the admin console using default credentials, upload a malicious Java archive as a web service, and execute arbitrary commands on the host via SOAP requests to the deployed service.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
BridgeHead Software FileStore
Default version status: unaffected
0 to < 24Aaffected
References
- https://gist.github.com/VAMorales/9e6a13d7529c079a363930dff48be3ba ↗
- https://www.bridgeheadsoftware.com/rapid-data-protection-product-updates/ ↗
- https://issues.apache.org/jira/browse/AXIS2-4279 ↗
- https://axis.apache.org/axis2/java/core/docs/webadminguide.html ↗
- https://www.vulncheck.com/advisories/bridgehead-filestore-24a-apache-axis2-default-credentials-rce ↗