A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods check_blob_push_org_label and get_matching_products_from_org take user-supplied labels directly from the request path and interpolate them into raw SQL fragments. This flaw is accessible to a user with only the create_personal_access_tokens permission, even if the user access is restricted, with no Organization or Location assigned.
Description
An authenticated SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController.
Specifically, the methods check_blob_push_org_label and get_matching_products_from_org take user-supplied labels directly from the request path and interpolate them into raw SQL fragments.
Crucially, this vulnerability is accessible to a user possessing only the create_personal_access_tokens permission (See F-36 Improper Authorization logic allows Resource Enumeration and F-37 Improper RBAC Mapping and Missing Filters Enable Unauthorized Controller Access). Even if the user access is restricted, with no Organization or Location assigned.
Affected Code in app/controllers/katello/api/registry/registry_proxies_controller.rb:
--------------------------------------------------------------------------------
Organization lookup
org = Organization.where("LOWER(label) = '#{org_label}'") # convert to lowercase
Product lookup
return organization.products.where("LOWER(label) = '#{product_label}'") # convert to lowercase
--------------------------------------------------------------------------------
Impact
Global Data Exfiltration: Low privileged users can bypass all logical data separation and multi-tenancy restrictions to dump the entire PostgreSQL database, including sensitive tables such as users and settings.
Vertical Privilege Escalation: By exfiltrating the users table, password hashes for administrative accounts (e.g., admin) can be recovered and cracked offline. No cleartext credentials were found, other sensitive credentials such as PATs and session_id are also hashed.
The Ruby pg driver used by ActiveRecord does not support stacked queries. This prevents the execution of direct DML/DDL statements (e.g., UPDATE, INSERT, DROP) through this specific injection vector. Therefore, the injection context is limited to SELECT statement fragments.
Recommendations
Implement Parameterized Queries: Modify RegistryProxiesController to use ActiveRecord's parameterized query syntax.
Proposed Fixes:
--------------------------------------------------------------------------------
org = Organization.where("LOWER(label) = ?", org_label.downcase)
return organization.products.where("LOWER(label) = ?", product_label.downcase)
--------------------------------------------------------------------------------
Apply Authorization Controls: Enforce a check to ensure the user has permissions for the specific Organization/Product before performing the database lookup.
This issue has been addressed in the following products:
Red Hat Satellite 6.16 for RHEL 8
Red Hat Satellite 6.16 for RHEL 9
Via RHSA-2026:74506 https://access.redhat.com/errata/RHSA-2026:74506
Description An authenticated SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. Specifically, the methods check_blob_push_org_label and get_matching_products_from_org take user-supplied labels directly from the request path and interpolate them into raw SQL fragments. Crucially, this vulnerability is accessible to a user possessing only the create_personal_access_tokens permission (See F-36 Improper Authorization logic allows Resource Enumeration and F-37 Improper RBAC Mapping and Missing Filters Enable Unauthorized Controller Access). Even if the user access is restricted, with no Organization or Location assigned. Affected Code in app/controllers/katello/api/registry/registry_proxies_controller.rb: -------------------------------------------------------------------------------- Organization lookup org = Organization.where("LOWER(label) = '#{org_label}'") # convert to lowercase Product lookup return organization.products.where("LOWER(label) = '#{product_label}'") # convert to lowercase -------------------------------------------------------------------------------- Impact Global Data Exfiltration: Low privileged users can bypass all logical data separation and multi-tenancy restrictions to dump the entire PostgreSQL database, including sensitive tables such as users and settings. Vertical Privilege Escalation: By exfiltrating the users table, password hashes for administrative accounts (e.g., admin) can be recovered and cracked offline. No cleartext credentials were found, other sensitive credentials such as PATs and session_id are also hashed. The Ruby pg driver used by ActiveRecord does not support stacked queries. This prevents the execution of direct DML/DDL statements (e.g., UPDATE, INSERT, DROP) through this specific injection vector. Therefore, the injection context is limited to SELECT statement fragments. Recommendations Implement Parameterized Queries: Modify RegistryProxiesController to use ActiveRecord's parameterized query syntax. Proposed Fixes: -------------------------------------------------------------------------------- org = Organization.where("LOWER(label) = ?", org_label.downcase) return organization.products.where("LOWER(label) = ?", product_label.downcase) -------------------------------------------------------------------------------- Apply Authorization Controls: Enforce a check to ensure the user has permissions for the specific Organization/Product before performing the database lookup.