A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.
Description
A command injection vulnerability exists in the foreman-rake errors:fetch_log task within Red Hat Satellite. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.
Impact
Successful exploitation allows a restricted user to escalate privileges to the foreman user and subsequently to root across all managed hosts, Organizations, and Locations. This represents a complete compromise of the Red Hat Satellite server and the entire infrastructure it manages.
Recommendations
Validate Input: Sanitize the request_id parameter to ensure it only contains alphanumeric characters and dashes, rejecting any input containing shell metacharacters.
Use Argument Arrays: Replace system calls that use shell string interpolation with array-based arguments to prevent shell interpretation (e.g., using Open3.capture3 with separate arguments in Ruby). Specifically, the following code in lib/tasks/errors.rake file should be replaced with something like this:
--------------------------------------------------------------------------------
// Vulnerable code
result = `grep "#{request_id}" "#{file_path}"`
This issue has been addressed in the following products:
Red Hat Satellite 6.16 for RHEL 8
Red Hat Satellite 6.16 for RHEL 9
Via RHSA-2026:74506 https://access.redhat.com/errata/RHSA-2026:74506
Description A command injection vulnerability exists in the foreman-rake errors:fetch_log task within Red Hat Satellite. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code. Impact Successful exploitation allows a restricted user to escalate privileges to the foreman user and subsequently to root across all managed hosts, Organizations, and Locations. This represents a complete compromise of the Red Hat Satellite server and the entire infrastructure it manages. Recommendations Validate Input: Sanitize the request_id parameter to ensure it only contains alphanumeric characters and dashes, rejecting any input containing shell metacharacters. Use Argument Arrays: Replace system calls that use shell string interpolation with array-based arguments to prevent shell interpretation (e.g., using Open3.capture3 with separate arguments in Ruby). Specifically, the following code in lib/tasks/errors.rake file should be replaced with something like this: -------------------------------------------------------------------------------- // Vulnerable code result = `grep "#{request_id}" "#{file_path}"`