Bug 1262443 (CVE-2015-5233)

Summary:	CVE-2015-5233 foreman: reports show/destroy not restricted by host authorization
Product:	[Other] Security Response	Reporter:	Kurt Seifried <kseifried>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abaron, aortega, apevec, ayoung, bkearney, chrisw, cpelland, dallan, gkotton, gmollett, jschluet, katello-bugs, lhh, lpeer, markmc, mburns, mmccune, ohadlevy, rbryant, rhos-maint, sclewis, slong, tdecacqu, tjay, tlestach, yeylon
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	A flaw was discovered where Satellite failed to properly enforce permissions on the show and delete actions for reports. An authenticated user with show or delete report permissions could use this flaw to view or delete any reports held in Foreman.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-12-15 10:53:34 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1263741
Bug Blocks:	1247734, 1262445

Description Kurt Seifried 2015-09-11 17:04:18 UTC

Dominic Cleal of the Red Hat Satellite Team reports:

Reports (from tools such as Puppet) are stored in Foreman and associated
to the host they came from. Users can be granted permissions to view
and/or destroy reports, and also separate permissions to view certain
hosts. The UI and API only list reports where the user has permission
to view both reports and the host it was from.

The security issue is that both the show and destroy actions for viewing
and deleting individual reports do not limit access to the hosts that
the user has permission to view. A user with permission to view or
destroy reports can do so for any host if they know the ID, or can
easily view the last report for a given host.

External Reference:
http://projects.theforeman.org/issues/11579

Comment 1 errata-xmlrpc 2015-12-15 09:19:29 UTC

This issue has been addressed in the following products:

  Red Hat Satellite 6.1

Via RHSA-2015:2622 https://access.redhat.com/errata/RHSA-2015:2622