CVE-2020-35459

Vulnerability

Overview

CVE-2020-35459 is a shell code injection vulnerability in ClusterLabs crmsh, a command-line management tool for the Pacemaker High Availability cluster stack. The flaw affects crmsh versions up to 4.2.1. The root cause is insufficient sanitization of user-supplied input passed to the crm history command, which is executed via a shell. Local attackers who are able to invoke crm history (when crm is run) can inject arbitrary shell commands through crafted arguments [1][2][3].

Attack

Vector and Prerequisites

The vulnerability can only be exploited by a local user who has the ability to run the crm tool. No authentication bypass is needed for the exploitation because the crm command relies on user-level access. The attacker provides specially crafted input to the crm history subcommand, which, due to insufficient quoting or validation, results in the input being interpreted as additional shell commands. This injection can be performed without needing any special privileges beyond running the crm tool [4][2].

Impact

Successful exploitation enables a local attacker to execute arbitrary shell commands with the privileges of the user running crm (often root or a user with elevated privileges for cluster management). This can lead to full compromise of the affected system, including privilege escalation and potentially cluster-wide disruption. The vulnerability was rated as important (CVSSv3 base score not assigned in references but described as 'important' by SUSE) [2][4].

Mitigation and

Patches

Mitigations include upgrading to a patched version of crmsh. References show that SUSE released security updates for affected products on 2021-01-12 (e.g., SUSE-SU-2021:0085-1 and SUSE-SU-2021:0086-1) and that upstream changes included avoiding shell constructs in favor of plain Python functions, such as using utils.mkdirp instead of system mkdir command [2]. Unpatched versions (through 4.2.1) remain vulnerable; users should update to crmsh 5.1.0 or later, as the changelog indicates fixes for similar issues [1].