Dominic Cleal of the Red Hat Satellite Team reports:

Reports (from tools such as Puppet) are stored in Foreman and associated to the host they came from. Users can be granted permissions to view and/or destroy reports, and also separate permissions to view certain hosts. The UI and API only list reports where the user has permission to view both reports and the host it was from.

The security issue is that both the show and destroy actions for viewing and deleting individual reports do not limit access to the hosts that the user has permission to view. A user with permission to view or destroy reports can do so for any host if they know the ID, or can easily view the last report for a given host.

External Reference: http://projects.theforeman.org/issues/11579

Description of problem:

The foreman & Katello projects received an upstream notification about the discovery of an authenticated sql injection vulnerability within katello:

Dear Katello/Foreman Team,

During an internal test it was discovered that the scoped search parameters sortby and sortorder are vulnerable to an authenticated SQL injection.

If we access: https://x.x.x.x/katello/api/v2/organizations/1/syncplans/1/products?availablefor=syncplan&fullresult=true&page=1&search=&sortby=name&sortorder=ASC'

we will see the following error:

{"displayMessage":"PG::Error: ERROR: unterminated quoted string at or near \"', katelloproducts.id <http://katelloproducts.id> DESC\"\nLINE 1: ...nid IS NULL)) ORDER BY katelloproducts.name <http://katelloproducts.name> ASC', katello...\n ^\n: SELECT \"katelloproducts\". FROM \"katelloproducts\" WHERE \"katelloproducts\".\"id\" IN (SELECT DISTINCT \"katelloproducts\".\"id\" FROM \"katelloproducts\" WHERE \"katelloproducts\".\"organizationid\" = 1 AND (katelloproducts.id <http://katelloproducts.id> in (NULL) or katelloproducts.id <http://katelloproducts.id> in (6,5,4,2,3,1)) AND (syncplanid != '1' OR syncplanid IS NULL)) ORDER BY katelloproducts.name <http://katelloproducts.name> ASC', katelloproducts.id <http://katelloproducts.id> DESC","errors":["PG::Error: ERROR: unterminated quoted string at or near \"', katelloproducts.id <http://katelloproducts.id> DESC\"\nLINE 1: ...nid IS NULL)) ORDER BY katelloproducts.name <http://katelloproducts.name> ASC', katello...\n

The injection can be exploited as a blind time based injection.

Best Regards Oliver

External reference: The line of code in question here is: https://github.com/Katello/katello/blob/KATELLO-3.0/app/controllers/katello/api/v2/apicontroller.rb#L67