REDHAT-BUG-2487511: SSRF
Description An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology / participating subsystems / hostnames). This is information disclosure at an authentication boundary: inventory/relationship metadata is exposed without requiring a principal, client cert, or session. An unauthenticated adversary with access to the network could enumerate PKI host/subsystem topology, target high-value Dogtag endpoints, or craft follow-on attacks (SSRF/pivots/phishing) using real internal names. Recommendations There is no reason to share the foreman version in the response and should be masked.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need?
An attacker only needs network access to the affected endpoint. No authenticated principal, client certificate, or session is required.
What information can be exposed?
The response can disclose Security Domain host inventory and relationship metadata, including internal PKI/CA hostnames, participating subsystems, roles, and security-domain topology.
Which environments should be prioritized for triage?
Prioritize deployments where unauthenticated clients can reach the CA REST interface. The disclosed topology can help attackers identify high-value Dogtag endpoints for follow-on targeting, including pivots, SSRF, or phishing.
What mitigation is identified if remediation cannot be applied immediately?
The provided recommendation is to mask the foreman version in the response, as there is no reason to disclose it. No other temporary mitigation or detection guidance is provided.