CVE-2018-10904

It was found that glusterfs server does not properly sanitize file paths in the “trusted.io-stats-dump” extended attribute which is used by the “debug/io-stats” translator. An attacker can use this flaw to create files and execute arbitrary code. To exploit this, the attacker would require sufficient access to modify the extended attributes of files on a gluster volume.

Mitigation

To limit exposure of gluster server nodes :

1. gluster server should be on LAN and not reachable from public networks.
2. Use gluster auth.allow and auth.reject.
3. Use TLS certificates to authenticate gluster clients.

caveat: This does not protect from attacks against authenticated gluster clients.