A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safeload to silently fall back to YAML.unsafeload in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects.

Red Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers.

A deserialization vulnerability was found in ManageIQ. The YamlLoadAliases module in lib/extensions/yamlloadaliases.rb overrides YAML.safeload globally. When a Psych::DisallowedClass error is raised in production, instead of raising the error, it silently falls back to YAML.unsafeload, which deserializes arbitrary Ruby objects. An authenticated user with dialog import access can upload a crafted YAML payload containing classes outside the permitted list to trigger the fallback and achieve Remote Code Execution via standard Ruby gadget chains.

The code comment explicitly labels this a "Temporary hack to fallback to psych 3 behavior" but it was never removed.

ManageIQ is an open-source management platform. A flaw was found in the ManageIQ API prior to version radjabov-2 where a malformed TimeProfile could be created causing later UI and API requests to timeout leading to a Denial of Service. Version radjabov-2 contains a patch. One may also apply the patch manually.

Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted input was included in command arguments, attacker could use this flaw to execute arbitrary command.

ManageIQ is an open-source management platform. In versions prior to jansa-4, kasparov-2, and lasker-1, there is a flaw in the MiqExpression module of ManageIQ where a low privilege user could enter a crafted Ruby string which would be evaluated. Successful exploitation will allow an attacker to execute arbitrary code with root privileges on the host system. There are patches for this issue in releases named jansa-4, kasparov-2, and lasker-1. If possible, restrict users, via RBAC, to only the part of the application that they need access to. While MiqExpression is widely used throughout the product, restricting users can limit the surface of the attack.

It was found that attacker having the access to appliance filesystem is able to execute arbitrary code under the same privileges as appliance runs. This issue is present since upstream commit f077196c99feb874e5cba8b93c1f8dfe26421c1b.

Upstream patch:

https://github.com/ManageIQ/manageiq/pull/7856

ManageIQ EVM is vulnerable to Cross-Site Request Forgery (CSRF) attacks. A remote attacker could provide a specially-crafted web page that, when visited by a user logged in to ManageIQ EVM, could allow the attacker to trigger actions on the ManageIQ EVM server in the context of the user.