REDHAT-BUG-1258700: Medium severity Foreman Foreman vulnerability
larry campbell reports via the foreman bug tracker:
This was found on Foreman 1.9.0:
I came across this issue by chance. I was forced to change my Active Directory password today. After doing so, I then (mistakenly) attempted to log onto Foreman with my previous password and was able to successfully log in. The new password also worked. I tried with other browsers and even another workstation that I had never logged onto and all attempts allowed me to log on with my non-valid previous password. Perhaps something on foreman/passenger/ruby/etc is caching my credential and not re-checking?
Initial Setup: Have an Active Directory enviornment available for LDAP Authentication. Setup LDAP Authentication Source in Foreman and have a test user account created in Active Directory.
Steps to recreate: 1. Log on to Foreman with the Active Directory user. This should succeed. Log off. 2. Change your Active Directory account's password. 3. Log on to Foreman with the Active Directory user, and use the previous password. This should fail with authentication denied method, however it succeeds.
Upstream references: http://projects.theforeman.org/issues/11471
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1258700?
The severity of REDHAT-BUG-1258700 is considered moderate due to potential unauthorized access after password changes.
How does REDHAT-BUG-1258700 impact Foreman users?
REHAT-BUG-1258700 allows users to log into Foreman with old Active Directory passwords, potentially compromising account security.
How do I fix REDHAT-BUG-1258700?
To fix REDHAT-BUG-1258700, users should ensure they are running the latest version of Foreman and follow any security updates released by the developers.
Is there a workaround for REDHAT-BUG-1258700?
A temporary workaround for REDHAT-BUG-1258700 is to manually verify password changes and monitor logins for unauthorized access.
When was REDHAT-BUG-1258700 reported?
REHAT-BUG-1258700 was reported by Larry Campbell via the Foreman bug tracker after he encountered the issue on Foreman 1.9.0.