CVE-2019-15897
📋 TL;DR
CVE-2019-15897 is an authentication bypass vulnerability in beegfs-ctl that allows attackers to communicate directly with BeeGFS metadata servers without proper authentication. This affects ThinkParQ BeeGFS installations through version 7.1.3. While metadata servers are typically not internet-facing, internal attackers or those who gain network access can exploit this.
💻 Affected Systems
- ThinkParQ BeeGFS
📦 What is this software?
Beegfs by Thinkparq
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the BeeGFS filesystem, allowing unauthorized access, modification, or deletion of all stored data, potentially leading to data loss or ransomware deployment.
Likely Case
Unauthorized access to sensitive files stored in BeeGFS, data exfiltration, or privilege escalation within the storage environment.
If Mitigated
Limited impact if metadata servers are properly isolated and network access controls prevent unauthorized connections.
🎯 Exploit Status
Exploitation requires network access to metadata server ports (typically TCP 8005). Public proof-of-concept code exists in Packet Storm references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.1.4 or later
Vendor Advisory: https://www.beegfs.io/content/
Restart Required: Yes
Instructions:
1. Upgrade BeeGFS to version 7.1.4 or later. 2. Restart all BeeGFS services including metadata servers. 3. Verify the patch is applied by checking version numbers.
🔧 Temporary Workarounds
Network Isolation
linuxRestrict network access to BeeGFS metadata server ports (typically TCP 8005) using firewall rules.
iptables -A INPUT -p tcp --dport 8005 -j DROP
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="TRUSTED_SUBNET" port port="8005" protocol="tcp" accept'
firewall-cmd --reload
Access Control Lists
linuxImplement network ACLs to only allow trusted hosts/subnets to connect to metadata servers.
iptables -A INPUT -p tcp --dport 8005 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 8005 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate metadata servers from untrusted networks.
- Monitor network traffic to metadata server ports for unauthorized connection attempts.
🔍 How to Verify
Check if Vulnerable:
Check BeeGFS version: beegfs-ctl --version. If version is 7.1.3 or earlier, system is vulnerable.Check Version:
beegfs-ctl --versionVerify Fix Applied:
After patching, verify version is 7.1.4 or later with: beegfs-ctl --version📡 Detection & Monitoring
Log Indicators:
- Unauthorized connection attempts to metadata server logs
- Unexpected beegfs-ctl commands from unauthorized hosts
Network Indicators:
- TCP connections to port 8005 from unauthorized IP addresses
- Unusual beegfs protocol traffic patterns
SIEM Query:
source_port=8005 AND (src_ip NOT IN [TRUSTED_SUBNETS])🔗 References
- http://packetstormsecurity.com/files/155573/BeeGFS-7.1.3-Privilege-Escalation.html
- https://seclists.org/bugtraq/2019/Dec/7
- https://www.hpcsec.com/2019/12/04/cve-2019-15897/
- http://packetstormsecurity.com/files/155573/BeeGFS-7.1.3-Privilege-Escalation.html
- https://seclists.org/bugtraq/2019/Dec/7
- https://www.hpcsec.com/2019/12/04/cve-2019-15897/
