CVE-2020-35458

Name of the Vulnerable Software and Affected Versions ClusterLabs Hawk versions 2.x through 2.3.0-x

Description The issue exists due to the lack of neutralization of special elements used in the operating system command. This allows a remote attacker to execute arbitrary code. Specifically, there is a Ruby shell code injection issue via the hawk remember me id parameter in the login from cookie cookie. The user logout routine can be used by unauthenticated remote attackers to execute code as hauser.

Recommendations For versions 2.x through 2.3.0-x, consider disabling the hawk remember me id parameter in the login from cookie cookie as a temporary workaround to minimize the risk of exploitation. Restrict access to the user logout routine to prevent unauthenticated remote attackers from executing code as hauser.