An authentication bypass vulnerability exists in Foreman due to Pulpcore when deployed with Gunicorn versions earlier than 22.0. The issue arises from how Apache’s modproxy handles header as it fails to unset it properly due to restrictions on underscores in HTTP headers. This allow authentication through malformed header instead. This flaw affects all Katello/Satellite 6.10+ deployments using Pulpcore from version 4.0+ and could potentially allow unauthorized users to gain admin access.

Katello: Username in Notification page has cross site scripting

Katello has multiple XSS issues in various entities

Registry credentials are captured in plain text in dynflow task during repository discovery.

Upstream issue:

https://bugzilla.redhat.com/showbug.cgi?id=1730668

A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users.

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulnerable.

A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.

A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the repository id.

A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.

Description of problem:

The foreman & Katello projects received an upstream notification about the discovery of an authenticated sql injection vulnerability within katello:

Dear Katello/Foreman Team,

During an internal test it was discovered that the scoped search parameters sortby and sortorder are vulnerable to an authenticated SQL injection.

If we access: https://x.x.x.x/katello/api/v2/organizations/1/syncplans/1/products?availablefor=syncplan&fullresult=true&page=1&search=&sortby=name&sortorder=ASC'

we will see the following error:

{"displayMessage":"PG::Error: ERROR: unterminated quoted string at or near \"', katelloproducts.id <http://katelloproducts.id> DESC\"\nLINE 1: ...nid IS NULL)) ORDER BY katelloproducts.name <http://katelloproducts.name> ASC', katello...\n ^\n: SELECT \"katelloproducts\". FROM \"katelloproducts\" WHERE \"katelloproducts\".\"id\" IN (SELECT DISTINCT \"katelloproducts\".\"id\" FROM \"katelloproducts\" WHERE \"katelloproducts\".\"organizationid\" = 1 AND (katelloproducts.id <http://katelloproducts.id> in (NULL) or katelloproducts.id <http://katelloproducts.id> in (6,5,4,2,3,1)) AND (syncplanid != '1' OR syncplanid IS NULL)) ORDER BY katelloproducts.name <http://katelloproducts.name> ASC', katelloproducts.id <http://katelloproducts.id> DESC","errors":["PG::Error: ERROR: unterminated quoted string at or near \"', katelloproducts.id <http://katelloproducts.id> DESC\"\nLINE 1: ...nid IS NULL)) ORDER BY katelloproducts.name <http://katelloproducts.name> ASC', katello...\n

The injection can be exploited as a blind time based injection.

Best Regards Oliver

External reference: The line of code in question here is: https://github.com/Katello/katello/blob/KATELLO-3.0/app/controllers/katello/api/v2/apicontroller.rb#L67

Jan Rusnacko of Red Hat reports:

Katello code exposes potential tosym Denial of Service attack vector from user input parameters. The two places identified are:

https://github.com/Katello/katello/blob/9231e24f93fa804e557fc95637cfa2c5bb92f6a7/app/controllers/katello/contentsearchcontroller.rb#L617

https://github.com/Katello/katello/blob/9231e24f93fa804e557fc95637cfa2c5bb92f6a7/app/controllers/katello/api/apicontroller.rb#L87

This type of attack is documented here - http://docs.fedoraproject.org/en-US/FedoraSecurityTeam/1/html/SecureRubyDevelopmentGuide/RubySymbols.html

This has been confirmed in testing by Eric Helms of Red Hat.

Hayk Hovsepyan hhovsepy reports:

When user without remove system permissions calls CLI command "system removedeletion", it finishes successfully without any warning.

modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.

Aaron Weitekamp (aweiteka) reports:

Description of problem: /etc/katello/secure/passphrase is world readable. File and directory should be secured. [root@qeblade40 ~]# ls -la /etc/katello/secure total 12 drwxr-xr-x. 2 root root 4096 Nov 13 09:11 . drwxr-xr-x. 3 root root 4096 Nov 14 11:22 .. -rw-r--r--. 1 root root 65 Nov 13 09:11 passphrase [root@qeblade40 ~]# rpm -qf /etc/katello/secure katello-selinux-1.1.1-2.el6cf.noarch [root@qeblade40 ~]# rpm -qf /etc/katello/secure/passphrase file /etc/katello/secure/passphrase is not owned by any package

Version-Release number of selected component (if applicable): 1.1 [root@qeblade40 ~]# rpm -qa |grep katello katello-cli-1.1.8-12.el6cf.noarch katello-1.1.12-22.el6cf.noarch katello-qpid-broker-key-pair-1.0-1.noarch katello-certs-tools-1.1.8-1.el6cf.noarch katello-candlepin-cert-key-pair-1.0-1.noarch katello-glue-pulp-1.1.12-22.el6cf.noarch katello-all-1.1.12-22.el6cf.noarch katello-cli-common-1.1.8-12.el6cf.noarch katello-glue-candlepin-1.1.12-22.el6cf.noarch katello-selinux-1.1.1-2.el6cf.noarch katello-qpid-client-key-pair-1.0-1.noarch katello-common-1.1.12-22.el6cf.noarch katello-configure-1.1.9-12.el6cf.noarch

Steps to Reproduce: 1. ls -la /etc/katello/secure 2. rpm -qf /etc/katello/secure Actual results: File and directory are world readable