eDeploy has tmp file race condition flaws

eDeploy has RCE via cPickle deserialization of untrusted data

eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data

eDeploy makes it easier for remote attackers to execute arbitrary code by leveraging use of HTTP to download files.

Kurt Seifried of Red Hat reports:

edeploy uses HTTP to download a large number of sensitive files which can lead to code execution:

./ansible/edeploy-install.yml: value=http://{{ ansibledefaultipv4["address"] }}/ ./build/base.install: echo "Acquire { Retries \"0\"; HTTP { Proxy \"http://${HTTPPROXY}\"; }; };" >> "$target/etc/apt/apt.conf.d/01proxy" ./build/base.install: curl -o ${target}/tmp/tar.deb http://ftp.debian.org/debian/pool/main/t/tar/tar1.27.1-1~bpo70+1${ARCH:=amd64}.deb ./build/base.install: echo "deb http://security.ubuntu.com/ubuntu $dist-security main universe multiverse" >> ${target}/etc/apt/sources.list ./build/base.install: echo "deb http://security.debian.org/ $dist/updates main" > ${target}/etc/apt/sources.list.d/updates.list ./build/base.install: wget -O - http://hwraid.le-vert.net/debian/hwraid.le-vert.net.gpg.key | dochroot $target apt-key add - ./build/base.install: echo "deb http://hwraid.le-vert.net/debian ${dist} main" > $target/etc/apt/sources.list.d/hwraid.list ./build/base.install: wget -O - http://hwraid.le-vert.net/ubuntu/hwraid.le-vert.net.gpg.key | dochroot $target apt-key add - ./build/base.install: echo "deb http://hwraid.le-vert.net/ubuntu precise main" > $target/etc/apt/sources.list.d/hwraid.list ./build/base.install: wget -O - http://hwraid.le-vert.net/ubuntu/hwraid.le-vert.net.gpg.key | dochroot $target apt-key add - ./build/base.install: echo "deb http://hwraid.le-vert.net/ubuntu ${dist} main" > $target/etc/apt/sources.list.d/hwraid.list ./build/base.install: wget --no-verbose http://downloads.linux.hp.com/SDR/downloads/MCP/pool/non-free/$packagename -O $target/../../$packagename ./build/base.install: http://downloads.linux.hp.com/SDR/downloads/ServicePackforProLiant/2013.02.0/hp/swpackages/hpacucli-9.40-12.0.x8664.rpm ./build/base.install: dochroot $dir rpm --import http://downloads.linux.hp.com/SDR/hpPublicKey1024.pub ./build/base.install: dochroot $dir rpm --import http://downloads.linux.hp.com/SDR/hpPublicKey2048.pub ./build/base.install:baseurl=http://downloads.linux.hp.com/repo/spp/rhel/$CODENAMEMAJOR.$CODENAMEMINOR/x8664/current ./build/common: wget --no-verbose http://us.archive.ubuntu.com/ubuntu/ubuntu/pool/universe/libm/libmlx4/$LIBMLX ./build/health-check.install: PACKAGES="$PACKAGES numpy http://pkgs.repoforge.org/netperf/netperf-2.6.0-1.el6.rf.x8664.rpm" ./build/health-check.install: PACKAGES="$PACKAGES python-psutil http://pkgs.repoforge.org/fio/fio-2.1.7-1.el6.rf.x8664.rpm http://pkgs.repoforge.org/lshw/lshw-2.17-1.el6.rf.x8664.rpm" ./build/health-check.install: PACKAGES="$PACKAGES http://pkgs.repoforge.org/fio/fio-2.1.7-1.el7.rf.x8664.rpm http://pkgs.repoforge.org/lshw/lshw-2.17-1.el7.rf.x8664.rpm" ./build/init: curl -s -S -o/configure -F section=${SECTION} -F file=@/hw.json http://${SERV}:${HTTPPORT}/${HTTPPATH}/upload.py & ./build/init: giveup "Curl exited as failed ($RETCODE). Cannot get a configuration from http://${SERV}:${HTTPPORT}/${HTTPPATH}/upload.py'" ./build/init: log "Transferring files from http://${HSERV}:${HSERVPORT}/${HPATH}/${VERS}/${ROLE}-${VERS}.edeploy..." ./build/init: curl -s -S http://${HSERV}:${HSERVPORT}/${HPATH}/${VERS}/${ROLE}-${VERS}.edeploy | gzip -d | tar x --xattrs --selinux -C $d || giveup "Unable to download http://${HSERV}:${HSERVPORT}/${HPATH}/${VERS}/${ROLE}-${VERS}.edeploy" ./build/init.common: curl http://169.254.169.254/2009-04-04/user-data -fso /user-data -m 5 --retry 10 --retry-delay 2 ./build/init.common: curl -s -S -o/log.stats -F section=${SECTION} -F file=@/${logfile} http://${SERV}:${HTTPPORT}/${HTTPPATH}/upload.py || : ./build/init.common: curl -s -S -F section=${SECTION} -F failure=$PROFILE -F file=@/hw.json http://${SERV}:${HTTPPORT}/${HTTPPATH}/upload.py ./build/init.health:curl -s -S $SESSIONCURL -F file=@/health.json http://${SERV}:${HTTPPORT}/${HTTPPATH}/upload-health.py & ./build/init.health: log "Curl exited as failed ($RETCODE). Cannot get a configuration from http://${SERV}:${HTTPPORT}/${HTTPPATH}/upload-health.py'" ./build/pxe.install: PACKAGES="$PACKAGES http://pkgs.repoforge.org/lshw/lshw-2.17-1.el6.rf.x8664.rpm" ./build/repositories: echo "http://http.debian.net/debian" ./build/repositories: echo "http://archive.ubuntu.com/ubuntu" ./build/repositories: echo "http://mirror.centos.org/centos/6.5/os/x8664/Packages/centos-release-6-5.el6.centos.11.1.x8664.rpm" ./build/repositories: echo "http://mirror.centos.org/centos/7/os/x8664/Packages/centos-release-7-0.1406.el7.centos.2.3.x8664.rpm" ./build/repositories: wget "http://dev.centos.org/centos/6/SCL/scl.repo" -O $dir/etc/yum.repos.d/scl.repo Binary file ./build/sources/lshw matches ./server/edeploy.conf:PXEMNGRURL=http://192.168.122.1:8000/ ./server/upload-health.py:$ curl -i -F name=test -F file=@/tmp/hw.lst http://localhost/cgi-bin/upload.py ./server/upload.py:$ curl -i -F name=test -F file=@/tmp/hw.lst http://localhost/cgi-bin/upload.py ./setup.cfg:home-page = http://www.enovance.com/ ./src/sampledmesg: Command line: BOOTIMAGE=vmlinuz initrd=http://10.101.14.14/health.pxe DEBUG=1 SERV=10.101.14.14 HSERV=10.101.14.14 UPLOADLOG=1 IP=all:dhcp SESSION=smoke NONETWORKTEST=1 ONSUCCESS=console ONFAILURE=console |pci=bfsort| ./src/sampledmesg: Kernel command line: BOOTIMAGE=vmlinuz initrd=http://10.101.14.14/health.pxe DEBUG=1 SERV=10.101.14.14 HSERV=10.101.14.14 UPLOADLOG=1 IP=all:dhcp SESSION=smoke NONETWORKTEST=1 ONSUCCESS=console ONFAILURE=console |pci=bfsort|

A path traversal flaw was found in eDeploy's session parameter handler. A remote attacker could use this flaw to create arbitrary directories on the server, potentially leading to a denial-of-service.