REDHAT-BUG-2524899: Medium severity the Foreman Project Foreman vulnerability
The reported issue is a valid object-level authorization bypass in Foreman's template revision handling.
TemplatesController#revision (app/controllers/templatescontroller.rb) loads the requested audit with Audit.find(params[:version]). The corresponding API controllers use Audit.authorized(:viewauditlogs).find(params[:version]). The UI action is a collection endpoint and is not subject to findresource, so authorization checks only whether the user may invoke the action (for example viewptables). It does not authorize the specific audit object supplied by the user.
An authenticated, low-privileged user with a template permission such as viewptables, scoped to one organization or location, can therefore retrieve a historical template revision from another organization or location by supplying its audit identifier. This is possible without viewauditlogs and without access to the template through the normal template API. The same revision action is inherited by partition table, provisioning template, report template, and remote execution job template controllers.
The exposed data is the historical template content, which may include sensitive configuration, credentials, or other secrets depending on customer configuration. This unrestricted lookup has been present since the introduction of STI templates.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated low-privileged user who has a template-related permission, such as view_ptables, scoped to any organization or location can exploit it. The user does not need view_audit_logs or normal API access to the target template.
What does an attacker need to retrieve another scope's revision?
The attacker needs to supply the identifier of the target audit record to the revision action. Authorization verifies that the user may invoke the action, but does not authorize access to that specific audit object.
Which template types are affected?
The inherited revision action affects partition table, provisioning template, report template, and remote execution job template controllers, in addition to template revision handling.
What information could be exposed?
Historical template content from another organization or location may be disclosed. That content can include sensitive configuration, credentials, or other sensitive data stored in template revisions.