CVE-2021-3469: Medium severity theforeman foreman vulnerability
Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and allow-authorization-extensions is set to false unless user change /etc/puppetlabs/puppetserver/conf.d/ca.conf configuration explicitly.
Other sources
The SmartProxyAuth of the Foreman allows controllers to authenticate certain requests based on the client certificate. As Puppet CA will consider subject alternative names (SANs) from a certificate along with Common name (CN); Puppet CA will sign the certificate with SANs pointing at DNS names of the already existing certificate. An attacker can obtain a new certificate by crafting Certificate Signing Request (CSR) made up with CN & SSNs and can able to impersonation foreman-proxy to accept the request.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/foremanto a version that resolves this vulnerability.Fixed in 2.3.4 - Upgrade
Upgrade
redhat/foremanto a version that resolves this vulnerability.Fixed in 2.4.0 - Upgrade
Upgrade
Foremanto a version that resolves this vulnerability.Fixed in 2.3.4 - Upgrade
Upgrade
Foremanto a version that resolves this vulnerability.Fixed in 2.4.0 - Configuration
Ensure allow-authorization-extensions is set to false in /etc/puppetlabs/puppetserver/conf.d/ca.conf to prevent Puppet CA from authorizing/signing certificate requests with SANs in a way that enables impersonation of foreman-proxy.
Puppet Server CA (/etc/puppetlabs/puppetserver/conf.d/ca.conf) allow-authorization-extensions = false - Compensating control
Use the SmartProxyAuth behavior of Foreman (client certificate-based authentication) to ensure only controllers are allowed to authenticate requests based on the client certificate.
Event History
Frequently Asked Questions
What is CVE-2021-3469?
CVE-2021-3469 is a vulnerability in Foreman versions before 2.3.4 and before 2.4.0 that allows an authenticated attacker to impersonate the foreman-proxy if the product enables the Puppet Certificate authority (CA) to sign certificate requests with subject alternative names (SANs).
How does CVE-2021-3469 impact Foreman?
CVE-2021-3469 can be exploited by an authenticated attacker to impersonate the foreman-proxy and perform unauthorized actions.
What is the severity of CVE-2021-3469?
CVE-2021-3469 has a severity rating of medium (5.4) based on the Common Vulnerability Scoring System (CVSS) v3.0.
Which versions of Foreman are affected by CVE-2021-3469?
Foreman versions before 2.3.4 and before 2.4.0 are affected by CVE-2021-3469.
How can the CVE-2021-3469 vulnerability be mitigated?
To mitigate CVE-2021-3469, users are advised to upgrade their Foreman software to version 2.3.4 or higher.