REDHAT-BUG-2145254: Medium severity Red Hat Satellite vulnerability
Satellite is executing external requests via the Referer header under the /location/clear path. It is possible to trigger an external interaction to an attacker's server, by executing a GET request to /locations/clear and modifying the Referer header to an attacker-controlled server.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Red Hat Satellite deployments are exposed if an attacker can send a GET request to the affected location-clearing endpoint with a controlled Referer header.
What does an attacker need to control to trigger the external interaction?
The attacker needs to issue the GET request and supply a Referer header pointing to an attacker-controlled server. The reported behavior causes Satellite to make an external request to that server.
Where can remediation information be found?
The provided references include Red Hat advisories RHSA-2023:6818 and RHSA-2024:1061, as well as Bugzilla issue 2248886.