REDHAT-BUG-1243571: Medium severity foreman vulnerability
Dominic Cleal of Red Hat reports:
The "requiressl" setting (in /etc/foreman/settings.yml) should enforce that web requests sent to Foreman over HTTP are redirected to HTTPS, but this was found not to happen with API requests (e.g. from Hammer CLI). Foreman will process API requests over HTTP, but should have redirected.
Redirection won't help with credentials having already been sent, but should give some notification that the user/app is using the wrong URL.
Affects all versions of Foreman since 1.1.
The issue has already been fixed since Foreman 1.9.0-RC1 via a refactor in #10471.
To mitigate this with Apache, add a stanza to the HTTP VirtualHost (e.g. in /etc/httpd/conf.d/05-foreman.d/apiredirect.conf) similar to:
RewriteEngine On RewriteRule ^/api/(.) https://%{SERVERNAME}/api/$1 [R,L]
External reference:
http://projects.theforeman.org/issues/11119
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1243571?
The severity of REDHAT-BUG-1243571 is classified as a security issue due to the lack of redirection of API requests from HTTP to HTTPS.
How do I fix REDHAT-BUG-1243571?
To fix REDHAT-BUG-1243571, ensure that all API requests are made over HTTPS by updating your application configuration.
What are the affected versions of Foreman for REDHAT-BUG-1243571?
Affected versions include Red Hat Foreman from 1.1 to 1.9.0-RC1.
What impacts does REDHAT-BUG-1243571 have on security?
REDHAT-BUG-1243571 could expose sensitive data through unencrypted API requests over HTTP.
Is there a workaround for REDHAT-BUG-1243571?
A possible workaround for REDHAT-BUG-1243571 is to manually enforce HTTPS for API requests via server configuration until a permanent fix is applied.