REDHAT-BUG-2488952: Input Validation
Description
A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/jobinvocations). When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input provided during the API request. Crucially, this exploitation does not rely on the content or logic of the Job Template/playbook itself; rather, the injection occurs during the instantiation of the job execution environment by the Satellite server. An attacker with permissions to execute job templates can inject arbitrary shell commands into this parameter, which are executed on the target infrastructure with the privileges of the execution user.
Impact
An attacker with limited job execution privileges can gain full administrative control over managed hosts. By injecting malicious commands, they can bypass intended playbook restrictions, escalate privileges, and compromise the confidentiality, integrity, and availability of the entire managed infrastructure.
Recommendations
Implement strict input validation and white-listing for the effectiveuser parameter to ensure it only contains valid usernames and no shell metacharacters (e.g., ;, &, |, $).
Ensure the underlying execution engine uses safe API calls for user switching that do not involve shell evaluation of the username string.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement strict validation and allow-listing for the effective_user parameter so API requests cannot provide shell metacharacters.
Red Hat Satellite API (/api/v2/job_invocations) effective_user input validation = Allow only valid usernames; reject shell metacharacters such as ;, &, |, and $ - Compensating control
Configure the underlying execution engine to use safe API calls for user switching without shell evaluation of the username string.
Event History
Frequently Asked Questions
Which environments are exposed to exploitation?
Managed hosts are exposed when a job template has effective_user marked overridable: true and an attacker can execute that template through the Satellite API. The injected commands run on the target infrastructure with the privileges of the execution user.
What access does an attacker need?
The attacker needs permissions to execute job templates. They can supply a malicious effective_user value to the /api/v2/job_invocations API endpoint; exploitation does not depend on the job template or playbook content.
Are templates protected by playbook restrictions still at risk?
Yes. The injection occurs while the Satellite server instantiates the job execution environment, before it depends on the template or playbook logic. An attacker can bypass intended playbook restrictions and execute arbitrary shell commands.
What mitigation is available if remediation cannot be applied immediately?
Restrict job-template execution permissions and ensure effective_user is not overridable where possible. Validate and allow-list effective_user values so they contain only valid usernames and no shell metacharacters.