Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.

A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be exploited by authenticated attacker while setuping conversion host through Infrastructure Migration Solution. This flaw allows attacker to execute arbitrary commands on CloudForms server.

A insecure configuration for certificate verification (http.verifymode = OpenSSL::SSL::VERIFYNONE) may lead to verification bypass in Red Hat CloudForms 5.x.

A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as.

Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, which allows remote authenticated users to execute arbitrary shell commands by leveraging the ability to view and filter collections.

It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated attacker could use this flaw to execute arbitrary VMs on systems managed by CloudForms if they know the ID of the VM.

A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on the CloudForms server as root.

CFME: CSRF protection vulnerability via permissive check of the referrer header

Jan Rusnacko of the Red Hat Product Security Team reports:

CFME contains an authorization bypass issue in the action rbacuseredit, which allows authenticated users with minimal privileges to gain access to additional privileges.

The problem is in the method checkprivileges in vmdb/app/controllers/applicationcontroller.rb:

def checkgenericrbac ident = "#{controllername}#{actionname}"

if MiqProductFeature.featureexists?(ident) passed = roleallows(:feature => ident, :any => true) unless passed if request.xmlhttprequest? render :update do |page| page.redirectto :controller => 'dashboard', :action => 'autherror' end else redirectto(:controller => 'dashboard', :action => 'autherror') end end passed else validateroute(controllername, request.env['REQUESTMETHOD'], actionname) end end

Since there is no else branch for the "if MiqProductFeature.featureexists?(ident)", any feature that is missing from the list of known features, will be allowed by default. One of these such features is opsrbacuseredit.

This is the same exact place in code that is causing CVE-2014-0078, however, the fix for this issue solves only CVE-2014-0078, not the problem itself. After the fix is applied, privileges for xbutton are checked, but other actions like rbacuseredit are allowed by default.

The Red Hat CloudForms Management Engine 5.1 allow remote administrators to execute arbitrary Ruby code via unspecified vectors.

CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user.

It was found that the MiqPolicyController component of CloudForms Management Engine (CFME) was vulnerable to SQL injection. A remote attacker could use this flaw to execute arbitrary SQL statements in the CFME database.

CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.

It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat Virtualization (RHEV) and OpenShift. This would allow an attacker to spoof RHEV or OpenShift systems and potentially harvest sensitive information from CloudForms.

An XML eXternal Entity (XXE) flaw was found in Nokogiri, a Ruby gem for parsing HTML, XML, and SAX. Using external XML entities, a remote attacker could specify a URL in a specially crafted XML that, when parsed, would cause a connection to that URL to be opened.

A patch shipped with the 1.5.4 release of Nokogiri provided a "nonet" option to disable external connections. However, local file URLs could still be used to exploit this flaw. The 1.6.4 release of Nokogiri fixed this issue by using libxml2 2.9.0.

Additional information is detailed at:

https://github.com/sparklemotion/nokogiri/issues/693#issuecomment-68334768

CVE request and assignment:

http://seclists.org/oss-sec/2015/q1/57

Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static secrettoken.rb secret.

A vulnerability has been found in nxosfilecopy from Ansible module. Filenames are used to perform actions to copy files to a flash or bootflash on NXOS devices. However, nxosfilecopy takes remotefile parameter which is used for destination. Malicious code could crafts the filename parameter to take advantage by performing an OS command injection.

Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add Ansible Tower provider, an attacker could scan and attack systems from the internal network which are not normally accessible.

Kurt Seifried of Red Hat Product Security reports:

======================================== ./lib/util/MiqSshUtilV1.rb def shellexec(cmd, doneStr=nil, shell=@shell) if shell # Writing to a temp remote script to handle cases where the cmd string is # too long and is truncated. tempremotescript = "/var/tmp/miq-#{Time.now.toi}.sh" self.exec("echo \"#{cmd}\" > #{tempremotescript}") self.exec("chmod 700 #{tempremotescript}") out = shell.sendcommand(tempremotescript) self.exec("rm -f #{tempremotescript}") @status = out.status msg = out.stdout

# Check if the first output return references the remote script and remove it. msgs = msg.split("\n") msg = msgs[1..-1].join("\n") if msgs[0].include?(tempremotescript)

raise "#{msg}" unless doneStr.nil? || msg.include?(doneStr) return msg else return self.exec(cmd, doneStr) end end ======================================== ./lib/util/MiqSshUtilV2.rb def tempcmdfile(cmd) tempremotescript = "/var/tmp/miq-#{Time.now.toi}.sh" self.exec("echo \"#{cmd}\" > #{tempremotescript}") remotecmd = "chmod 700 #{tempremotescript}; #{tempremotescript}; rm -f #{tempremotescript}" yield(remotecmd) end ======================================== Time.now.toi = 1412123123 setup a file and a few hundred/thousand symlinks and you can cover an hour easily.

Between the

self.exec("echo \"#{cmd}\" > #{tempremotescript}") self.exec("chmod 700 #{tempremotescript}")

an attacker can replace the file, which is then executed as root.

It should use Ruby Tempfile: http://kurt.seifried.org/2012/03/14/creating-temporary-files-securely/

A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting in CloudForms 5.9.3.1 build due to improper sanitization of user input in Name field.

Jan Rusnacko of Red Hat reports:

current CFME code contains dangerous send in cfme/vmdb/app/controllers/applicationcontroller/performance.rb :

747: prpt.whereclause[2] = @perfrecord.send(@perfoptions[:parent].underscore).id

This calls .send method on @perfrecord, with argument @perfoptions[:parent], which is supplied by user:

29: @perfoptions[:parent] = params[:compareto].blank? ? nil : params[:compareto] if params.haskey?(:compareto)

CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges.

A stored cross-site scripting (XSS) vulnerability was found in the PDF export component of CloudForms, versions 5.9 and 5.10, due to user input is not properly sanitized. An attacker with least privilege to edit compute is able to execute a XSS attack against other users, which could lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users.

Aaron Patterson of Red Hat reports:

There are a number of locations in the code where .tosym is called on user supplied code, resulting in a potential DoS condition as an attacker can insert symbols that are never garbage collected.

A cross-site script vulnerability was found in CloudForms 5.9.0.10 self-service UI snapshot feature.

A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protectfromforgery XSRF protection causing the routes to be used. This attack would require additional cross-site scripting or similar attacks in order to execute.

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag nolog set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

CFME (CloudForms Management Engine) 5: RHN account information is logged to topoutput.log during registration

Internally CFME uses AES-256-CBC encryption to encrypt important data before it is saved in the database. This encryption mode is vulnerable to padding oracle attack and CFME does allow attacker to submit forged ciphertexts for encryption and observe the result.

A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms including data such as newly created virtual machines.