OS Command Injection in Foreman - CVE-2023-0118

Vulnerability identifier: #VU78931

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-0118

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when processing templates . A remote privileged user can bypass safe mode and inject and execute arbitrary OS commands via the Report Templates function by modifying the "template" JSON value in the POST request.

Foreman
Red Hat Satellite
Red Hat Enterprise Linux for x86_64
yggdrasil-worker-forwarder (Red Hat package)
rubygem-hammer_cli_foreman_ansible (Red Hat package)
python-future (Red Hat package)
rubygem-foreman_maintain (Red Hat package)
tfm-rubygem-safemode (Red Hat package)
rubygem-safemode (Red Hat package)
tfm-rubygem-rchardet (Red Hat package)
rubygem-rchardet (Red Hat package)
tfm-rubygem-git (Red Hat package)
rubygem-git (Red Hat package)
foreman (Red Hat package)
rubygem-fog-vsphere (Red Hat package)
python-pulp-rpm (Red Hat package)
python-pulpcore (Red Hat package)
rubygem-katello (Red Hat package)
satellite (Red Hat package)
puppet-agent (Red Hat package)
rubygem-foreman_ansible (Red Hat package)

Install updates from vendor's website.

Red Hat Satellite - addressed in versions 6.11.5.6, 6.12.5.2, 6.13.3, 6.14
yggdrasil-worker-forwarder (Red Hat package) - addressed in versions 0.0.3-1.el7sat, 0.0.3-1.el8sat
rubygem-hammer_cli_foreman_ansible (Red Hat package) - update to 0.5.0-1.el8sat
python-future (Red Hat package) - update to 0.18.3-1.el8pc
rubygem-foreman_maintain (Red Hat package) - update to 1.2.11-1.el8sat
tfm-rubygem-safemode (Red Hat package) - update to 1.3.8-0.1.el7sat
rubygem-safemode (Red Hat package) - addressed in versions 1.3.8-0.1.el8sat, 1.3.8-1.el8sat
tfm-rubygem-rchardet (Red Hat package) - update to 1.8.0-0.1.el7sat
rubygem-rchardet (Red Hat package) - update to 1.8.0-0.1.el8sat
tfm-rubygem-git (Red Hat package) - update to 1.18.0-0.1.el7sat
rubygem-git (Red Hat package) - addressed in versions 1.18.0-0.1.el8sat, 1.18.0-1.el8sat
foreman (Red Hat package) - addressed in versions 3.1.1.27-1.el7sat, 3.1.1.27-1.el8sat, 3.3.0.23-1.el8sat, 3.5.1.19-1.el8sat
rubygem-fog-vsphere (Red Hat package) - update to 3.6.2-1.el8sat
python-pulp-rpm (Red Hat package) - update to 3.18.17-1.el8pc
python-pulpcore (Red Hat package) - update to 3.21.9-1.el8pc
rubygem-katello (Red Hat package) - update to 4.7.0.31-1.el8sat
satellite (Red Hat package) - addressed in versions 6.11.5.6-1.el7sat, 6.11.5.6-1.el8sat, 6.12.5.2-1.el8sat, 6.13.3-1.el8sat
puppet-agent (Red Hat package) - addressed in versions 7.26.0-3.el7sat, 7.26.0-3.el8sat
rubygem-foreman_ansible (Red Hat package) - update to 10.4.3-1.el8sat

• https://bugzilla.redhat.com/show_bug.cgi?id=2159291

• OS Command Injection in Foreman
• Multiple vulnerabilities in Red hat Satellite
• Multiple vulnerabilities in Red Hat Satellite 6.11
• Multiple vulnerabilities in Red Hat Satellite 6.12
• Multiple vulnerabilities in Red Hat Satellite 6.14