Clusterlabs Hawk up to 2.3.0-15 tools/hawk_invoke.c command injection

Summaryinfo

A vulnerability classified as very critical has been found in Clusterlabs Hawk up to 2.3.0-15. Impacted is an unknown function of the file tools/hawk_invoke.c. The manipulation leads to an unknown weakness. This vulnerability is documented as CVE-2021-3020. The attack can be initiated remotely. There is not any exploit available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in Clusterlabs Hawk up to 2.3.0-15 and classified as very critical. This issue affects some unknown processing of the file tools/hawk_invoke.c. Using CWE to declare the problem leads to CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to limit this to safe combinations). This user is able to execute an interactive "shell" that isn't limited to the commands specified in hawk_invoke, allowing escalation to root.

The weakness was released 08/26/2022 as c538024b8ebd138dc373b005189471d9b77e9c82. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2021-3020 since 01/05/2021. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/02/2022). The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

Applying the patch c538024b8ebd138dc373b005189471d9b77e9c82 is able to eliminate this problem. The bugfix is ready for download at github.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Clusterlabs

Name

• Hawk

Version

• 2.3.0-15

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion