Jan Rusnacko of Red Hat reports:

current CFME code contains dangerous send in cfme/vmdb/app/controllers/applicationcontroller/performance.rb :

747: prpt.whereclause[2] = @perfrecord.send(@perfoptions[:parent].underscore).id

This calls .send method on @perfrecord, with argument @perfoptions[:parent], which is supplied by user:

29: @perfoptions[:parent] = params[:compareto].blank? ? nil : params[:compareto] if params.haskey?(:compareto)

lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords via a brute force attack.

Kurt Seifried of Red Hat Product Security reports:

======================================== ./lib/util/MiqSshUtilV1.rb def shellexec(cmd, doneStr=nil, shell=@shell) if shell # Writing to a temp remote script to handle cases where the cmd string is # too long and is truncated. tempremotescript = "/var/tmp/miq-#{Time.now.toi}.sh" self.exec("echo \"#{cmd}\" > #{tempremotescript}") self.exec("chmod 700 #{tempremotescript}") out = shell.sendcommand(tempremotescript) self.exec("rm -f #{tempremotescript}") @status = out.status msg = out.stdout

# Check if the first output return references the remote script and remove it. msgs = msg.split("\n") msg = msgs[1..-1].join("\n") if msgs[0].include?(tempremotescript)

raise "#{msg}" unless doneStr.nil? || msg.include?(doneStr) return msg else return self.exec(cmd, doneStr) end end ======================================== ./lib/util/MiqSshUtilV2.rb def tempcmdfile(cmd) tempremotescript = "/var/tmp/miq-#{Time.now.toi}.sh" self.exec("echo \"#{cmd}\" > #{tempremotescript}") remotecmd = "chmod 700 #{tempremotescript}; #{tempremotescript}; rm -f #{tempremotescript}" yield(remotecmd) end ======================================== Time.now.toi = 1412123123 setup a file and a few hundred/thousand symlinks and you can cover an hour easily.

Between the

self.exec("echo \"#{cmd}\" > #{tempremotescript}") self.exec("chmod 700 #{tempremotescript}")

an attacker can replace the file, which is then executed as root.

It should use Ruby Tempfile: http://kurt.seifried.org/2012/03/14/creating-temporary-files-securely/

Cross-site scripting (XSS) vulnerability in application/panelcontrol in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The waitfortask function in app/controllers/applicationcontroller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via unspecified vectors.

Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file.

IssueDescription:

It was found that Red Hat CloudForms exposed default routes that were reachable via HTTP(S) requests. An authenticated user could use this flaw to access potentially sensitive controllers and actions that would allow for privilege escalation.