REDHAT-BUG-2547044: High severity Red Hat candlepin vulnerability
A flaw was found in candlepin. The VerifyAuthorizationFilter.hasAccess method uses a shared boolean that is set true when any verified entity is accessible and is never reset. On REST methods that declare two or more @Verify parameters, authorization failures on later parameters only break an inner loop and do not deny the request if an earlier parameter was accessible. A low-privilege authenticated principal who can access the first verified entity can therefore operate on later entities they are not authorized to access. This affects multiple multi-@Verify API endpoints and can allow cross-Owner (organization) operations when target resource identifiers are known, including listing consumer information, binding to entitlement pools, adding or removing pools on activation keys, and revoking entitlements. Impact is highest on multi-tenant Candlepin deployments such as subscription.rhsm.redhat.com; Satellite is also affected. Reported privately via PSIRTSUPT-24926; keep embargoed pending reporter/customer response on coordinated disclosure.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be prioritized for assessment?
Multi-tenant Candlepin deployments have the highest impact because the flaw can enable cross-Owner operations. The issue also affects Satellite.
What level of access does an attacker need?
An attacker needs to be an authenticated low-privilege principal that can access the first entity checked by an affected API endpoint. They also need to know the identifiers of target resources they are not authorized to access.
What unauthorized actions may be possible?
Affected multi-@Verify API endpoints may permit cross-Owner listing of consumer information, binding to entitlement pools, adding or removing pools on activation keys, and revoking entitlements.