A vulnerability has been found in nxosfilecopy from Ansible module. Filenames are used to perform actions to copy files to a flash or bootflash on NXOS devices. However, nxosfilecopy takes remotefile parameter which is used for destination. Malicious code could crafts the filename parameter to take advantage by performing an OS command injection.

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag nolog set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

An XML eXternal Entity (XXE) flaw was found in Nokogiri, a Ruby gem for parsing HTML, XML, and SAX. Using external XML entities, a remote attacker could specify a URL in a specially crafted XML that, when parsed, would cause a connection to that URL to be opened.

A patch shipped with the 1.5.4 release of Nokogiri provided a "nonet" option to disable external connections. However, local file URLs could still be used to exploit this flaw. The 1.6.4 release of Nokogiri fixed this issue by using libxml2 2.9.0.

Additional information is detailed at:

https://github.com/sparklemotion/nokogiri/issues/693#issuecomment-68334768

CVE request and assignment:

http://seclists.org/oss-sec/2015/q1/57

The Red Hat CloudForms Management Engine 5.1 allow remote administrators to execute arbitrary Ruby code via unspecified vectors.

Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.

It was found that the MiqPolicyController component of CloudForms Management Engine (CFME) was vulnerable to SQL injection. A remote attacker could use this flaw to execute arbitrary SQL statements in the CFME database.

Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static secrettoken.rb secret.

A insecure configuration for certificate verification (http.verifymode = OpenSSL::SSL::VERIFYNONE) may lead to verification bypass in Red Hat CloudForms 5.x.

Aaron Patterson of Red Hat reports:

There are a number of locations in the code where .tosym is called on user supplied code, resulting in a potential DoS condition as an attacker can insert symbols that are never garbage collected.

Jan Rusnacko of Red Hat reports:

current CFME code contains dangerous send in cfme/vmdb/app/controllers/applicationcontroller/performance.rb :

747: prpt.whereclause[2] = @perfrecord.send(@perfoptions[:parent].underscore).id

This calls .send method on @perfrecord, with argument @perfoptions[:parent], which is supplied by user:

29: @perfoptions[:parent] = params[:compareto].blank? ? nil : params[:compareto] if params.haskey?(:compareto)

CFME (CloudForms Management Engine) 5: RHN account information is logged to topoutput.log during registration

lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords via a brute force attack.

Kurt Seifried of Red Hat Product Security reports:

======================================== ./lib/util/MiqSshUtilV1.rb def shellexec(cmd, doneStr=nil, shell=@shell) if shell # Writing to a temp remote script to handle cases where the cmd string is # too long and is truncated. tempremotescript = "/var/tmp/miq-#{Time.now.toi}.sh" self.exec("echo \"#{cmd}\" > #{tempremotescript}") self.exec("chmod 700 #{tempremotescript}") out = shell.sendcommand(tempremotescript) self.exec("rm -f #{tempremotescript}") @status = out.status msg = out.stdout

# Check if the first output return references the remote script and remove it. msgs = msg.split("\n") msg = msgs[1..-1].join("\n") if msgs[0].include?(tempremotescript)

raise "#{msg}" unless doneStr.nil? || msg.include?(doneStr) return msg else return self.exec(cmd, doneStr) end end ======================================== ./lib/util/MiqSshUtilV2.rb def tempcmdfile(cmd) tempremotescript = "/var/tmp/miq-#{Time.now.toi}.sh" self.exec("echo \"#{cmd}\" > #{tempremotescript}") remotecmd = "chmod 700 #{tempremotescript}; #{tempremotescript}; rm -f #{tempremotescript}" yield(remotecmd) end ======================================== Time.now.toi = 1412123123 setup a file and a few hundred/thousand symlinks and you can cover an hour easily.

Between the

self.exec("echo \"#{cmd}\" > #{tempremotescript}") self.exec("chmod 700 #{tempremotescript}")

an attacker can replace the file, which is then executed as root.

It should use Ruby Tempfile: http://kurt.seifried.org/2012/03/14/creating-temporary-files-securely/

Cross-site scripting (XSS) vulnerability in application/panelcontrol in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The waitfortask function in app/controllers/applicationcontroller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via unspecified vectors.

Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file.

The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.

CFME: CSRF protection vulnerability via permissive check of the referrer header

IssueDescription:

It was found that Red Hat CloudForms exposed default routes that were reachable via HTTP(S) requests. An authenticated user could use this flaw to access potentially sensitive controllers and actions that would allow for privilege escalation.

Jan Rusnacko of the Red Hat Product Security Team reports:

CFME contains an authorization bypass issue in the action rbacuseredit, which allows authenticated users with minimal privileges to gain access to additional privileges.

The problem is in the method checkprivileges in vmdb/app/controllers/applicationcontroller.rb:

def checkgenericrbac ident = "#{controllername}#{actionname}"

if MiqProductFeature.featureexists?(ident) passed = roleallows(:feature => ident, :any => true) unless passed if request.xmlhttprequest? render :update do |page| page.redirectto :controller => 'dashboard', :action => 'autherror' end else redirectto(:controller => 'dashboard', :action => 'autherror') end end passed else validateroute(controllername, request.env['REQUESTMETHOD'], actionname) end end

Since there is no else branch for the "if MiqProductFeature.featureexists?(ident)", any feature that is missing from the list of known features, will be allowed by default. One of these such features is opsrbacuseredit.

This is the same exact place in code that is causing CVE-2014-0078, however, the fix for this issue solves only CVE-2014-0078, not the problem itself. After the fix is applied, privileges for xbutton are checked, but other actions like rbacuseredit are allowed by default.

It is reported that CloudForms fails to protect potentially sensitive data stored in the backend PostgreSQL database. This is due to encrypted data being decrypted and then stashed in data structures which may be inadvertently exposed (e.g. through database log files).

A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability within the API could potentially view data from other tenants or groups to which they should not have access.

Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, which allows remote authenticated users to execute arbitrary shell commands by leveraging the ability to view and filter collections.

It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated attacker could use this flaw to execute arbitrary VMs on systems managed by CloudForms if they know the ID of the VM.

A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as.

CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.

Internally CFME uses AES-256-CBC encryption to encrypt important data before it is saved in the database. This encryption mode is vulnerable to padding oracle attack and CFME does allow attacker to submit forged ciphertexts for encryption and observe the result.

A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms including data such as newly created virtual machines.

A cross-site script vulnerability was found in CloudForms 5.9.0.10 self-service UI snapshot feature.

CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges.