CVE-2014-0057: Code Injection
Jan Rusnacko of the Red Hat Product Security Team reports:
CFME contains an unsafe invocation of send method on user-supplied argument. This issue is reported by Brakeman as problem in ServiceController method xbutton:
vmdb/app/controllers/servicecontroller.rb
16 def xbutton 17 @explorer = true 18 model, action = pressed2modelaction(params[:pressed]) 19 @sb[:action] = action 20 if ["ownership","tag"].include?(action) 21 self.send(params[:pressed],"Service") 22 else 23 self.send(params[:pressed]) 24 end
Assuming pressed2modelaction sanitizes user input, this look like false-positive. However, pressed2modelaction does not do sanitization, and only splits string on underscore:
def pressed2modelaction(pressed) pressed =~ /^(vmvdi|miqtemplate)(.)$/ ? [$1, $2] : pressed.split('', 2) end
If action parsed from user-supplied input is neither "ownership", nor "tag", else branch is executed and client can execute arbitrary method on controller, including private.
Other sources
The xbutton method in the ServiceController (vmdb/app/controllers/servicecontroller.rb) in Red Hat CloudForms 3.0 Management Engine 5.2 allows remote attackers to execute arbitrary methods via unspecified vectors.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0057?
CVE-2014-0057 has been classified with a moderate severity level due to the potential for arbitrary code execution.
How do I fix CVE-2014-0057?
To fix CVE-2014-0057, upgrade to the latest patched version of Red Hat CloudForms or Red Hat CloudForms Management Engine.
Which versions are affected by CVE-2014-0057?
CVE-2014-0057 affects Red Hat CloudForms 3.0 and Red Hat CloudForms Management Engine 5.2.
Is CVE-2014-0057 exploitable remotely?
Yes, CVE-2014-0057 is considered remotely exploitable as it involves user-supplied arguments.
What products does CVE-2014-0057 affect?
CVE-2014-0057 specifically affects Red Hat CloudForms and Red Hat CloudForms Management Engine.