Bug 1207589 (CVE-2015-1844)

Summary:	CVE-2015-1844 foreman: API not scoping resources to taxonomies
Product:	[Other] Security Response	Reporter:	Vasyl Kaigorodov <vkaigoro>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abaron, aortega, apevec, ayoung, bkearney, chrisw, cpelland, cperry, dallan, gkotton, gmollett, jrusnack, lhh, lpeer, markmc, mburns, mhulan, mmccune, ohadlevy, rbryant, sclewis, security-response-team, tjay, yeylon
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	foreman 1.7.5	Doc Type:	Bug Fix
Doc Text:	A flaw was found in the way foreman authorized user actions on resources via the API when an organization was not explicitly set. A remote attacker could use this flaw to obtain additional information about resources they were not authorized to access.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-02-22 03:42:21 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1208071, 1208080
Bug Blocks:	1145400, 1207590, 1253077

Description Vasyl Kaigorodov 2015-03-31 09:13:20 UTC

It was discovered that in Foreman API it's possible to retrieve any organization information, if the organization is not explicitely set in the API request.
The fix should make sure that if user does not specify an org explicitly - he's scoped to his orgs only.
Initially reported in Foreman public mailing list:

https://groups.google.com/forum/#!topic/foreman-users/qAGZh5n6n6M

Comment 1 Vasyl Kaigorodov 2015-03-31 09:17:18 UTC

Upstream bug report: http://projects.theforeman.org/issues/9947

Comment 4 Ján Rusnačko 2015-04-03 11:05:14 UTC

Pull request:

https://github.com/theforeman/foreman/pull/2273

Comment 5 errata-xmlrpc 2015-08-12 04:52:01 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.1

Via RHSA-2015:1591 https://access.redhat.com/errata/RHSA-2015:1591

Comment 6 errata-xmlrpc 2015-08-12 05:30:49 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.1

Via RHSA-2015:1592 https://access.redhat.com/errata/RHSA-2015:1592