An object-level authorization bypass in Katello's Content View Filter Rules API.

Katello::Api::V2::ContentViewFilterRulesController#findfilter (app/controllers/katello/api/v2/contentviewfilterrulescontroller.rb) loads the parent filter with ContentViewFilter.find(params[:contentviewfilterid]). That beforeaction runs for every action. The rules route is top-level and carries no content view identifier, so this lookup is the only object resolution in the request. Authorization only checks whether the user may invoke the action (viewcontentviews for read, editcontentviews for write). It does not authorize the Content View Filter supplied by the user.

The adjacent ContentViewFiltersController already resolves filters with ContentViewFilter.readable.findby(...) for reads and ContentViewFilter.editable.findby(...) for modifications. ContentViewFilter has no default organization scope; readable and editable are explicit class methods and are unused here. Katello::Model does not include Authorizable, so there is no post-save permission rollback when a rule is created or deleted.

An authenticated, low-privileged user with Content View permissions scoped to one organization can therefore read, create, update, and delete filter rules on a Content View Filter belonging to another organization by supplying that filter's identifier, even when that filter is absent from ContentViewFilter.readable and ContentViewFilter.editable.

The disclosed data is filter-rule metadata. Modifications persist in the live filter configuration used for the next Content View publish. Already-published Content View versions are snapshots and are not rewritten by this endpoint. Publish and promote remain separate permissions.

A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View belonging to another organization by supplying its identifier to the affected API endpoint. This can result in unauthorized disclosure of Content View lifecycle information, including publication and promotion events, associated users, and timestamps.

An authorization bypass in Katello's Content View History API. The ContentViewHistoriesController resolves the requested Content View using an unrestricted ContentView.find(params[:contentviewid]) lookup instead of the authorization-aware ContentView.readable scope. As a result, an authenticated user with viewcontentviews permission for one organization may be able to supply the ID of a Content View belonging to another organization and retrieve its lifecycle history. The reported impact is limited to unauthorized disclosure of Content View lifecycle metadata, including publication and promotion events, associated users, and timestamps.

An authentication bypass vulnerability exists in Foreman due to Pulpcore when deployed with Gunicorn versions earlier than 22.0. The issue arises from how Apache’s modproxy handles header as it fails to unset it properly due to restrictions on underscores in HTTP headers. This allow authentication through malformed header instead. This flaw affects all Katello/Satellite 6.10+ deployments using Pulpcore from version 4.0+ and could potentially allow unauthorized users to gain admin access.

Katello: Username in Notification page has cross site scripting

Katello has multiple XSS issues in various entities

Registry credentials are captured in plain text in dynflow task during repository discovery.

Upstream issue:

https://bugzilla.redhat.com/showbug.cgi?id=1730668

A cleartext password storage issue was discovered in Katello, versions 3.x.x.x before katello 3.12.0.9. Registry credentials used during container image discovery were inadvertently logged without being masked. This flaw could expose the registry credentials to other privileged users.

A SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query to the backend database, which will leak internal IDs. This is issue is related to an incomplete fix for CVE-2016-3072. Version 3.10 and older is vulnerable.

A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before 3.9.0 are vulnerable.

A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the repository id.

A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.

Description of problem:

The foreman & Katello projects received an upstream notification about the discovery of an authenticated sql injection vulnerability within katello:

Dear Katello/Foreman Team,

During an internal test it was discovered that the scoped search parameters sortby and sortorder are vulnerable to an authenticated SQL injection.

If we access: https://x.x.x.x/katello/api/v2/organizations/1/syncplans/1/products?availablefor=syncplan&fullresult=true&page=1&search=&sortby=name&sortorder=ASC'

we will see the following error:

{"displayMessage":"PG::Error: ERROR: unterminated quoted string at or near \"', katelloproducts.id <http://katelloproducts.id> DESC\"\nLINE 1: ...nid IS NULL)) ORDER BY katelloproducts.name <http://katelloproducts.name> ASC', katello...\n ^\n: SELECT \"katelloproducts\". FROM \"katelloproducts\" WHERE \"katelloproducts\".\"id\" IN (SELECT DISTINCT \"katelloproducts\".\"id\" FROM \"katelloproducts\" WHERE \"katelloproducts\".\"organizationid\" = 1 AND (katelloproducts.id <http://katelloproducts.id> in (NULL) or katelloproducts.id <http://katelloproducts.id> in (6,5,4,2,3,1)) AND (syncplanid != '1' OR syncplanid IS NULL)) ORDER BY katelloproducts.name <http://katelloproducts.name> ASC', katelloproducts.id <http://katelloproducts.id> DESC","errors":["PG::Error: ERROR: unterminated quoted string at or near \"', katelloproducts.id <http://katelloproducts.id> DESC\"\nLINE 1: ...nid IS NULL)) ORDER BY katelloproducts.name <http://katelloproducts.name> ASC', katello...\n

The injection can be exploited as a blind time based injection.

Best Regards Oliver

External reference: The line of code in question here is: https://github.com/Katello/katello/blob/KATELLO-3.0/app/controllers/katello/api/v2/apicontroller.rb#L67

Jan Rusnacko of Red Hat reports:

Katello code exposes potential tosym Denial of Service attack vector from user input parameters. The two places identified are:

https://github.com/Katello/katello/blob/9231e24f93fa804e557fc95637cfa2c5bb92f6a7/app/controllers/katello/contentsearchcontroller.rb#L617

https://github.com/Katello/katello/blob/9231e24f93fa804e557fc95637cfa2c5bb92f6a7/app/controllers/katello/api/apicontroller.rb#L87

This type of attack is documented here - http://docs.fedoraproject.org/en-US/FedoraSecurityTeam/1/html/SecureRubyDevelopmentGuide/RubySymbols.html

This has been confirmed in testing by Eric Helms of Red Hat.

Hayk Hovsepyan hhovsepy reports:

When user without remove system permissions calls CLI command "system removedeletion", it finishes successfully without any warning.

modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.

Aaron Weitekamp (aweiteka) reports:

Description of problem: /etc/katello/secure/passphrase is world readable. File and directory should be secured. [root@qeblade40 ~]# ls -la /etc/katello/secure total 12 drwxr-xr-x. 2 root root 4096 Nov 13 09:11 . drwxr-xr-x. 3 root root 4096 Nov 14 11:22 .. -rw-r--r--. 1 root root 65 Nov 13 09:11 passphrase [root@qeblade40 ~]# rpm -qf /etc/katello/secure katello-selinux-1.1.1-2.el6cf.noarch [root@qeblade40 ~]# rpm -qf /etc/katello/secure/passphrase file /etc/katello/secure/passphrase is not owned by any package

Version-Release number of selected component (if applicable): 1.1 [root@qeblade40 ~]# rpm -qa |grep katello katello-cli-1.1.8-12.el6cf.noarch katello-1.1.12-22.el6cf.noarch katello-qpid-broker-key-pair-1.0-1.noarch katello-certs-tools-1.1.8-1.el6cf.noarch katello-candlepin-cert-key-pair-1.0-1.noarch katello-glue-pulp-1.1.12-22.el6cf.noarch katello-all-1.1.12-22.el6cf.noarch katello-cli-common-1.1.8-12.el6cf.noarch katello-glue-candlepin-1.1.12-22.el6cf.noarch katello-selinux-1.1.1-2.el6cf.noarch katello-qpid-client-key-pair-1.0-1.noarch katello-common-1.1.12-22.el6cf.noarch katello-configure-1.1.9-12.el6cf.noarch

Steps to Reproduce: 1. ls -la /etc/katello/secure 2. rpm -qf /etc/katello/secure Actual results: File and directory are world readable