CVE-2021-3020

Published August 26th, 2022

View on NVD ↗

CVSS v3

8.8

HIGH

CVSS v2

N/A

Affected

PROJECTS

Description

An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to limit this to safe combinations). This user is able to execute an interactive "shell" that isn't limited to the commands specified in hawk_invoke, allowing escalation to root.

ClusterLabs/hawk

A web-based GUI for managing and monitoring the Pacemaker High-Availability cluster resource manager

GitHub

154

ClusterLabs/crmsh

Command-line interface for High-Availability cluster management on GNU/Linux systems.

GitHub

142