Alexander Wels of Red Hat reported vulnerability allowing anybody possessing SuperUser role on any Entity to remotely execute arbitrary code as root on any host in RHEV environment. The vulnerability is in the feature that allows to view logs that reside on the hosts from inside the UI by selecting the log from the UI. It happens as following:

/ http request to /redhat-support-plugin- rhev/logs?path=<path+filename>&machine=<name of machine selected>/ / servlet handles the request, and passes the <path+filename> to an ssh client class./ / The ssh client connects to the selected machine and executes as root/ / 'stat - c %s ' + <path+filename>/

Nowhere in this sequence is the <path+filename> checked or validated. The only validation that happens is that the session associated with the request has the 'SuperUser' role. It doesn't matter what entity the role is on, it just has to have that role on any entity in the RHEV system. With fairly simple url parameter manipulation, an arbitrary code can be executed as root on any host in the RHEV system. Note that SuperUser on an Entity != ROOT on the hosts.

Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 ignores the permission to deny snapshot creation during live storage migration between domains, which allows remote authenticated users to cause a denial of service (prevent host start) by creating a long snapshot chain.

Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 uses weak permissions on the directories shared by the ovirt-engine-dwhd service and a plugin during service startup, which allows local users to obtain sensitive information by reading files in the directory.