Bug 2310406 (CVE-2024-8509)

Summary: CVE-2024-8509 Migration Toolkit for Virtualization: forklift-controller: Empty bearer token may perform authentication
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: VERIFIED --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: fdeutsch
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in Forklift Controller.  There is no verification against the authorization header except to ensure it uses bearer authentication. Without an Authorization header and some form of a Bearer token, a 401 error occurs. The presence of a token value provides a 200 response with the requested information.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2024-09-06 12:56:56 UTC 
It was identified a security vulnerability against the API. No verification is being performed against the Authorization header except ensuring that it uses bearer authentication. For example, a malicious user can make a query against the API with a random string bearer token as shown below:

curl -vvvkL -H "Authorization: Bearer foobar" "https://<forklift_inventory_route_hostname>/providers"

Without a Authorization header and some form of Bearer token, a 401 is produced. However, the mere presence of a token value provides a 200 response with the requested information.
Comment 1 Fabian Deutsch 2024-09-09 09:43:23 UTC 
Moving to verified according to MTV-1422
Comment 2 errata-xmlrpc 2024-09-09 10:39:33 UTC 
This issue has been addressed in the following products:

  Migration Toolkit for Virtualization 2.6

Via RHSA-2024:6487 https://access.redhat.com/errata/RHSA-2024:6487