REDHAT-BUG-2547766: Medium severity The Foreman Katello vulnerability
A flaw was found in Katello. The Flatpak Remote Repositories API resolves records with an unscoped FlatpakRemoteRepository.find in a beforeaction used by show and mirror, while the index path correctly uses FlatpakRemoteRepository.readable. An authenticated user with viewflatpakremotes in one organization can read another organization's flatpak remote repository metadata. The same unscoped finder backs the mirror action, which creates a repository in a product the attacker can edit using the victim organization's flatpak remote registry URL and stored remote credentials (username/token). Reported via PSIRTSUPT-25121.
Affected Software
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
An attacker must be authenticated and have the view_flatpak_remotes permission in at least one organization. They do not need access to the victim organization whose Flatpak remote repository they target.
What information can an unauthorized user obtain?
The user can read Flatpak remote repository metadata belonging to another organization through the affected show path. The issue results from the record lookup not being scoped to repositories the user is allowed to read.
Can the issue be used for more than cross-organization metadata access?
Yes. Through the mirror action, an attacker who can edit a product can create a repository using another organization's Flatpak remote registry URL and stored remote credentials, including its username or token.