CVE-2020-35458 Command injection in n/a

Critical 9.8 Published 12 Jan 2021 Updated 4 Aug 2024

Unauthenticated remote attackers can execute arbitrary code as hauser via Ruby shell code injection in the login_from_cookie parameter.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2020-35458?

CVE-2020-35458 is a critical command injection vulnerability in n/a, published on 12 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.

Weakness: CWE-78

Which versions are affected by CVE-2020-35458?

It affects 1 product.

Linux distribution packages (16)

`hawk2` SUSE:Linux Enterprise High Availability Extension 12 SP3	All versions	`2.4.0+git.1607523195.05cd3222-2.33.1`
`hawk2` SUSE:Linux Enterprise High Availability Extension 12 SP3	All versions	`2.5.0+git.1611141696.64c61e0c-2.36.1`
`hawk2` SUSE:Linux Enterprise High Availability Extension 12 SP4	All versions	`2.4.0+git.1607523195.05cd3222-3.21.1`
`hawk2` SUSE:Linux Enterprise High Availability Extension 12 SP4	All versions	`2.5.0+git.1611141696.64c61e0c-3.24.1`
`hawk2` SUSE:Linux Enterprise High Availability Extension 12 SP5	All versions	`2.4.0+git.1607523195.05cd3222-3.21.1`
`hawk2` SUSE:Linux Enterprise High Availability Extension 12 SP5	All versions	`2.5.0+git.1611141696.64c61e0c-3.24.1`
`hawk2` SUSE:Linux Enterprise High Availability Extension 15	All versions	`2.3.0+git.1603969748.10468582-3.18.1`
`hawk2` SUSE:Linux Enterprise High Availability Extension 15	All versions	`2.4.0+git.1611141202.2fe6369e-3.21.1`
`hawk2` SUSE:Linux Enterprise High Availability Extension 15 SP1	All versions	`2.3.0+git.1603969748.10468582-3.18.1`
`hawk2` SUSE:Linux Enterprise High Availability Extension 15 SP1	All versions	`2.4.0+git.1611141202.2fe6369e-3.21.1`
`hawk2` SUSE:Linux Enterprise High Availability Extension 15 SP2	All versions	`2.3.0+git.1603969748.10468582-3.18.1`
`hawk2` SUSE:Linux Enterprise High Availability Extension 15 SP2	All versions	`2.4.0+git.1611141202.2fe6369e-3.21.1`
`hawk2` openSUSE:Leap 15.1	All versions	`2.3.0+git.1603969748.10468582-lp151.2.18.1`
`hawk2` openSUSE:Leap 15.1	All versions	`2.4.0+git.1611141202.2fe6369e-lp151.2.21.1`
`hawk2` openSUSE:Leap 15.2	All versions	`2.3.0+git.1603969748.10468582-lp152.2.9.1`
`hawk2` openSUSE:Leap 15.2	All versions	`2.4.0+git.1611141202.2fe6369e-lp152.2.12.1`

Products include Clusterlabs Hawk.

How do I fix CVE-2020-35458?

Apply the vendor's patch.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2020-35458 being exploited?

There is no known exploitation of CVE-2020-35458 in the wild and no public exploit code.

CVE-2021-3020 Privilege escalation in n/a High 8.8

Sources

Also known as GHSA-mjxr-7f24-c564, SUSE-SU-2021:0088-1, SUSE-SU-2021:0089-1, SUSE-SU-2021:0090-1, SUSE-SU-2021:0192-1, SUSE-SU-2021:0198-1 and 5 more.