REDHAT-BUG-1322050: SQL Injection

First published: Tue Mar 29 2016(Updated: )

Description of problem: The foreman &amp; Katello projects received an upstream notification about the discovery of an authenticated sql injection vulnerability within katello: Dear Katello/Foreman Team, During an internal test it was discovered that the scoped search parameters sort_by and sort_order are vulnerable to an authenticated SQL injection. If we access: <a href="https://x.x.x.x/katello/api/v2/organizations/1/sync_plans/1/products?available_for=sync_plan&amp;full_result=true&amp;page=1&amp;search=&amp;sort_by=name&amp;sort_order=ASC">https://x.x.x.x/katello/api/v2/organizations/1/sync_plans/1/products?available_for=sync_plan&amp;full_result=true&amp;page=1&amp;search=&amp;sort_by=name&amp;sort_order=ASC</a>' we will see the following error: {"displayMessage":"PG::Error: ERROR: unterminated quoted string at or near \"', katello_products.id &lt;<a href="http://katello_products.id">http://katello_products.id</a>&gt; DESC\"\nLINE 1: ...n_id IS NULL)) ORDER BY katello_products.name &lt;<a href="http://katello_products.name">http://katello_products.name</a>&gt; ASC', katello...\n ^\n: SELECT \"katello_products\".* FROM \"katello_products\" WHERE \"katello_products\".\"id\" IN (SELECT DISTINCT \"katello_products\".\"id\" FROM \"katello_products\" WHERE \"katello_products\".\"organization_id\" = 1 AND (katello_products.id &lt;<a href="http://katello_products.id">http://katello_products.id</a>&gt; in (NULL) or katello_products.id &lt;<a href="http://katello_products.id">http://katello_products.id</a>&gt; in (6,5,4,2,3,1)) AND (sync_plan_id != '1' OR sync_plan_id IS NULL)) ORDER BY katello_products.name &lt;<a href="http://katello_products.name">http://katello_products.name</a>&gt; ASC', katello_products.id &lt;<a href="http://katello_products.id">http://katello_products.id</a>&gt; DESC","errors":["PG::Error: ERROR: unterminated quoted string at or near \"', katello_products.id &lt;<a href="http://katello_products.id">http://katello_products.id</a>&gt; DESC\"\nLINE 1: ...n_id IS NULL)) ORDER BY katello_products.name &lt;<a href="http://katello_products.name">http://katello_products.name</a>&gt; ASC', katello...\n The injection can be exploited as a blind time based injection. Best Regards Oliver External reference: The line of code in question here is: <a href="https://github.com/Katello/katello/blob/KATELLO-3.0/app/controllers/katello/api/v2/api_controller.rb#L67">https://github.com/Katello/katello/blob/KATELLO-3.0/app/controllers/katello/api/v2/api_controller.rb#L67</a>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/references
• agent/type
• agent/last-modified-date
• collector/redhat-bugzilla
• source/Red Hat
• alias/CVE-2016-3072
• agent/first-publish-date
• agent/severity
• agent/weakness
• agent/description
• agent/event
• agent/source
• agent/tags
• agent/softwarecombine
• agent/guess-ai
• agent/software-canonical-lookup
• agent/software-canonical-lookup-request
• vendor/katello
• canonical/katello