#VU11820 Privilege escalation in pcs - CVE-2018-1079

Vulnerability identifier: #VU11820

Vulnerability risk: Low

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-1079

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
pcs
Web applications / Remote management & hosting panels

Vendor: ClusterLabs

Description
The vulnerability allows a remote authenticated attacker to gain elevated privileges on the target system.

The weakness exists in the REST interface of the pcsd service due improper sanitization of the file name from the /remote/put_file query. A remote attacker can create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process and gain root privileges.

Mitigation
Update to versions 0.9.164 or 0.10.

Vulnerable software versions

pcs: 0.9.163

---

External links
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1079

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.