NetApp StorageGRID weakness can cause partial denial of service in non-standard deployments

StorageGRID (formerly StorageGRID Webscale) versions 11.5 and higher in a non-standard configuration and scenario are susceptible to a Denial of Service vulnerability. Successful exploit could allow an attacker with some control over the environment to cause a partial Denial of Service.

NetApp StorageGRID is the affected product. The structured affected data sets defaultStatus to unaffected while explicitly marking version 11.5 as affected. The CNA description also states that versions 11.5 and higher may be susceptible in a non-standard configuration and scenario. No branch-specific status for later releases or fixed release is supplied, so an unlisted branch should not be treated as confirmed safe.

NetApp classifies the weakness as CWE-774, involving allocation of file descriptors or handles without limits or throttling. This weakness class can exhaust a finite resource and reduce availability, but the record does not identify the specific StorageGRID component, endpoint, operation, or attacker-controlled value involved. Exploitation requires a non-standard configuration and scenario and an attacker with some control over the environment; the supplied vector also describes network reachability, low privileges, high complexity, a present attack requirement, and no user interaction. The documented outcome is a partial denial of service, with no stated confidentiality or integrity impact.

The issue requires network access and does not require user interaction. The record describes high attack complexity, low privileges, and a present attack requirement. The scenario also requires some control over the environment and a non-standard configuration or scenario. CISA ADP enrichment records exploitation as none and automatable as no; the record provides no specific public exploit details or indicators.

The documented technical outcome is a partial denial of service, meaning availability of the affected StorageGRID system may be reduced without necessarily stopping the entire deployment. The supplied vector indicates an availability impact to the vulnerable system but does not indicate confidentiality, integrity, or downstream-system impact. An organization may need to manage degraded storage operations or partial service interruption, but the affected services and scope are not specified.

A successful attack could partially reduce the availability of a StorageGRID deployment and disrupt related storage operations. The evidence does not specify which services would be affected or how long disruption could last. The supplied assessment does not indicate confidentiality or integrity impact, so the documented risk is limited to service availability. Because exploitation depends on a non-standard configuration and scenario, exposure is not confirmed for every StorageGRID deployment.

1. Use NetApp's advisory and support channels to obtain the current fix or mitigation. The evidence reviewed does not state a fixed release, patch, or workaround.
2. Inventory deployments within the affected release boundary and verify whether they use the non-standard configuration or scenario described by the advisory.
3. Prioritize systems that meet both the affected release and deployment conditions.
4. If NetApp identifies a branch-specific upgrade, apply the exact release confirmed for that branch. Do not infer that a later branch is unaffected merely because it is not listed in the current record.

1. Inventory NetApp StorageGRID deployments and compare their releases with the affected boundaries published by NetApp.
2. Review deployment configurations and operating scenarios to determine whether a non-standard configuration or scenario is present.
3. Identify low-privilege accounts, integrations, or components that have some control over the environment, and verify network reachability to the system.
4. Monitor for partial availability degradation or service disruption in StorageGRID as a precaution. This is general defensive monitoring, not a confirmed IOC; the evidence does not identify specific log events.