CVE-2018-1079 Path traversal in pcs
An authenticated attacker can exploit a path traversal flaw in the pcsd REST interface to overwrite arbitrary files, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1079?
CVE-2018-1079 is a high-severity path traversal vulnerability in Redhat Enterprise Linux, published on 12 Apr 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. The REST interface of the pcsd service did not properly sanitize the file name from the /remote/put_file query. If the /etc/booth directory exists, an authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process.
Which versions are affected by CVE-2018-1079?
It affects 2 products.
Products include Clusterlabs Pacemaker Command Line Interface, Redhat Enterprise Linux.
How do I fix CVE-2018-1079?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-1079 being exploited?
There is no known exploitation of CVE-2018-1079 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
Sources
Also known as DEBIAN-CVE-2018-1079, GHSA-wxjj-jh24-cx5f.