REDHAT-BUG-2527320: Medium severity Red Hat PCS (Pacemaker Configuration System) vulnerability
PCS (Pacemaker Configuration System) has an arbitrary file read vulnerability in the pcs host auth --token <path> command path. When a non-root user in the 'haclient' group runs this command, the nonrootrun() function in pcs/app.py forwards it to the locally running pcsd daemon via HTTP POST to /runpcs. The pcsd daemon (running as root) matches the command against its allowedcommands list in pcsd/pcsd.rb (['host', 'auth', '...']) with no restriction on --token, and re-executes PCS as root. This causes utils.gettokenfromfile() in pcs/utils.py to open and read the attacker-specified file path with root privileges, reading up to 256 bytes. The file contents are base64-encoded and stored as a token in the known-hosts configuration file. The attacker can exfiltrate the file contents by triggering node communication (e.g., pcs pcsd status) and intercepting the HTTP Cookie header containing the base64-encoded token.
Affected: PCS versions from 0.10.8 onwards (introduced in commit 9178b78d11baa70e700a5c0d9fc1c17f27d452fa). RHEL 8.4+, RHEL 9.0+, and RHEL 10.0+ ship affected PCS versions.
Fix: Upstream patch attached to PSIRTSUPT-22935 (commit b41eaf3c6e2ecfc575c42442fb02b8ef05b4dd6a, not yet on public GitHub main). Blocks pcs host auth --token for non-root users in both pcs/app.py and pcsd/pcsd.rb.
Reporter: Peter Romancik (PCS upstream developer, Red Hat). PSIRT ticket: PSIRTSUPT-22935
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A local non-root user who is a member of the haclient group can exploit it. The attack relies on the locally running pcsd daemon, which runs as root and re-executes the allowed command path.
What access and conditions are required for exploitation?
The attacker needs local command execution as a haclient-group user and access to a running local pcsd service. They can supply an arbitrary path to pcs host auth --token, causing up to 256 bytes of the referenced file to be read with root privileges.
Are default RHEL deployments affected?
Affected PCS versions are shipped with RHEL 8.4 and later, RHEL 9.0 and later, and RHEL 10.0 and later. The vulnerable behavior exists in PCS versions starting with 0.10.8.
How can the disclosed file data be recovered by an attacker?
The file content is base64-encoded and stored as a token in the known-hosts configuration. An attacker can trigger node communication, such as pcs pcsd status, and intercept the HTTP Cookie header containing that encoded token.
What can be done if the upstream fix cannot be applied immediately?
The provided information identifies membership in the haclient group as the required non-root privilege. Restricting that group to trusted administrators reduces exposure until the upstream patch is applied.