CVE-2023-0118: Foreman: arbitrary code execution through templates
First published: Mon Jan 09 2023(Updated: )
An admin user on Foreman can bypass safe mode in templates and execute arbitrary code via the Report Templates function. When changing the "template" JSON value in the POST request, an attacker can exploit the bind() call in safemode to inject an OS command in the underlying operating system.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Theforeman Foreman | ||
| Redhat Satellite | >=6.13<6.13.3 | |
| Redhat Enterprise Linux | =8.0 | |
| redhat/foreman | <6.13.3 | 6.13.3 |
| All of | ||
| Redhat Satellite | >=6.13<6.13.3 | |
| Redhat Enterprise Linux | =8.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2023:4466
- https://access.redhat.com/security/cve/CVE-2023-0118
- https://bugzilla.redhat.com/show_bug.cgi?id=2159291
- https://access.redhat.com/security/cve/cve-2023-0118
- https://access.redhat.com/errata/RHSA-2023:5979
- https://access.redhat.com/errata/RHSA-2023:5980
- https://access.redhat.com/errata/RHSA-2023:6818
Frequently Asked Questions
What is CVE-2023-0118?
CVE-2023-0118 is an arbitrary code execution flaw found in Foreman that allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.
How severe is CVE-2023-0118?
CVE-2023-0118 has a severity rating of 9.1, which is considered critical.
Which software is affected by CVE-2023-0118?
Foreman, Redhat Satellite (version 6.13.3 and earlier) are affected by CVE-2023-0118.
How can an admin user exploit CVE-2023-0118?
An admin user can exploit CVE-2023-0118 by bypassing safe mode in templates and executing arbitrary code on the underlying operating system.
Are Redhat Enterprise Linux 8.0 systems vulnerable to CVE-2023-0118?
No, Redhat Enterprise Linux 8.0 systems are not vulnerable to CVE-2023-0118.
- collector/nvd-index
- agent/author
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-0118
- agent/software-canonical-lookup
- agent/references
- agent/weakness
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/title
- agent/last-modified-date
- agent/event
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/theforeman
- canonical/theforeman foreman
- vendor/redhat
- canonical/redhat satellite
- version/redhat satellite/6.13
- canonical/redhat enterprise linux
- version/redhat enterprise linux/8.0
- package-manager/redhat