CVE-2021-3020

Vulnerability

An issue exists in ClusterLabs Hawk (HA Web Konsole) through version 2.3.0-15. The package ships a setuid binary hawk_invoke (built from tools/hawk_invoke.c), intended to allow the hacluster user to execute a limited set of commands as root. However, the implementation fails to restrict the execution to safe commands, allowing the hacluster user to run an interactive shell without limitations. The vulnerable versions include Hawk 2.3.0-15 and earlier [1][2].

Exploitation

The attacker must have access as the hacluster user, which is a legitimate system user for the cluster management. No additional authentication or privileges are required beyond this user account. The hacluster user can invoke hawk_invoke to execute an unrestricted interactive shell (e.g., /bin/sh), bypassing the intended command restrictions [1][2].

Impact

Successful exploitation allows the hacluster user to execute arbitrary commands as root, leading to full compromise of the affected system. The attacker gains root-level privileges, enabling complete control over the host, including reading and writing all files, installing software, and pivoting within the network [1][2].

Mitigation

The fix has been applied in Hawk version 2.6.15 for SLE15 and 2.6.12 for SLE12, which removes the hawk_invoke C binary and uses capture3 for running system commands instead of the runas construct that called hawk_invoke. Users should upgrade to the latest release from the official repository [2]. There is no known workaround for vulnerable versions other than upgrading.