REDHAT-BUG-2488952: Input Validation
Description
A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/jobinvocations). When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input provided during the API request. Crucially, this exploitation does not rely on the content or logic of the Job Template/playbook itself; rather, the injection occurs during the instantiation of the job execution environment by the Satellite server. An attacker with permissions to execute job templates can inject arbitrary shell commands into this parameter, which are executed on the target infrastructure with the privileges of the execution user.
Impact
An attacker with limited job execution privileges can gain full administrative control over managed hosts. By injecting malicious commands, they can bypass intended playbook restrictions, escalate privileges, and compromise the confidentiality, integrity, and availability of the entire managed infrastructure.
Recommendations
Implement strict input validation and white-listing for the effectiveuser parameter to ensure it only contains valid usernames and no shell metacharacters (e.g., ;, &, |, $).
Ensure the underlying execution engine uses safe API calls for user switching that do not involve shell evaluation of the username string.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement strict validation and allow-listing for the effective_user parameter so API requests cannot provide shell metacharacters.
Red Hat Satellite API (/api/v2/job_invocations) effective_user input validation = Allow only valid usernames; reject shell metacharacters such as ;, &, |, and $ - Compensating control
Configure the underlying execution engine to use safe API calls for user switching without shell evaluation of the username string.