Server-Side Request Forgery (SSRF) in Red Hat Satellite - CVE-2022-4130

Vulnerability identifier: #VU83505

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N]

CVE-ID: CVE-2022-4130

CWE-ID: CWE-918

Exploitation vector: Remote access

Exploit availability: No public exploit available

The disclosed vulnerability allows a remote user to perform SSRF attacks.

The vulnerability exists due to insufficient validation of HTTP Referer header at "/locations/clear". A remote authenticated user can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.

Red Hat Satellite
Red Hat Enterprise Linux for x86_64
rubygem-foreman_leapp (Red Hat package)
createrepo_c (Red Hat package)
mosquitto (Red Hat package)
python-pulp-container (Red Hat package)
satellite-clone (Red Hat package)
foreman (Red Hat package)
foreman-installer (Red Hat package)
ansible-collection-redhat-satellite (Red Hat package)
python-pulp-rpm (Red Hat package)
rubygem-katello (Red Hat package)
satellite (Red Hat package)
rubygem-foreman_bootdisk (Red Hat package)

Install updates from vendor's website.

Red Hat Satellite - update to 6.14
rubygem-foreman_leapp (Red Hat package) - update to 0.1.13-2.el8sat
createrepo_c (Red Hat package) - update to 1.0.2-2.el8pc
mosquitto (Red Hat package) - update to 2.0.17-1.el8sat
python-pulp-container (Red Hat package) - update to 2.14.11-1.el8pc
satellite-clone (Red Hat package) - update to 3.5.0-1.el8sat
foreman (Red Hat package) - update to 3.5.1.24-1.el8sat
foreman-installer (Red Hat package) - update to 3.5.2.7-1.el8sat
ansible-collection-redhat-satellite (Red Hat package) - update to 3.9.0-3.el8sat
python-pulp-rpm (Red Hat package) - update to 3.18.19-2.el8pc
rubygem-katello (Red Hat package) - update to 4.7.0.36-1.el8sat
satellite (Red Hat package) - update to 6.13.7-1.el8sat
rubygem-foreman_bootdisk (Red Hat package) - update to 21.0.5-1.el8sat

• https://bugzilla.redhat.com/show_bug.cgi?id=2145254

• Multiple vulnerabilities in Red Hat Satellite 6.14
• Multiple vulnerabilities in Red Hat Satellite 6.13 for RHEL 8