CVE-2018-1079: Path Traversal
A security issue was found in pcs deamon that permits an authorized user (with write permission in pcsd) to escalate privileges and write to any file in the system using a malicious REST call.
Other sources
pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. The REST interface of the pcsd service did not properly sanitize the file name from the /remote/putfile query. If the /etc/booth directory exists, an authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2018-1079.
What is the severity level of CVE-2018-1079?
The severity level of CVE-2018-1079 is high.
Which software versions are affected by CVE-2018-1079?
PCS versions before 0.9.164 and 0.10 are affected by CVE-2018-1079.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by making a malicious REST call through the pcsd service.
Are there any patches or fixes available for CVE-2018-1079?
Yes, Red Hat has released a patch for this vulnerability. Please refer to the provided references for more information.