High severity · published Aug 26, 2022
CVE-2021-3020
An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15
8.8
CVSS
1.3%
EPSS
No
On KEV
Description
An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to limit this to safe combinations). This user is able to execute an interactive "shell" that isn't limited to the commands specified in hawk_invoke, allowing escalation to root.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
Hawk · Clusterlabs
through 2.3.0-15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3020
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3020
Permissions Required
https://bugzilla.suse.com/show_bug.cgi?id=1180571
Patch
https://github.com/ClusterLabs/crmsh/commit/c538024b8ebd138dc373b005189471d9b77e9c82
Release Notes
https://github.com/ClusterLabs/hawk/releases
More from Hawk
9.8
CVE-2020-35458
An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x