REDHAT-BUG-2536844: High severity Foreman Foreman vulnerability
When accessing certain API endpoints (e.g. POSTing to /template/preview) a user with the Viewer role is able to access information they should not be able to (i.e. @host.rootpass). When the system is configured insecurely (i.e. Safemode is disabled), or a Safemode bypass vulnerability exists, then the Viewer is able to perform Remote Code Execution on the system as the foreman system account.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user assigned the Viewer role can access sensitive information through certain API endpoints, including POST requests to /template/preview. Remote code execution additionally requires Safemode to be disabled or a separate Safemode bypass vulnerability to exist.
Are systems with Safemode enabled still at risk?
The Viewer-role information disclosure is described independently of Safemode. Safemode affects the remote-code-execution condition: RCE is possible when Safemode is disabled or when it can be bypassed.
What privileges would successful code execution have?
Code execution runs as the foreman system account.
What should be prioritized if immediate remediation is not possible?
Ensure Safemode remains enabled and investigate whether any Safemode bypass vulnerability is present. Also limit Viewer-role access because Viewer users can reach the affected API functionality.