Bug 1262443 - (CVE-2015-5233) CVE-2015-5233 foreman: reports show/destroy not restricted by host authorization
CVE-2015-5233 foreman: reports show/destroy not restricted by host authorization
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 1263741
Blocks: 1247734 1262445
  Show dependency treegraph
Reported: 2015-09-11 13:04 EDT by Kurt Seifried
Modified: 2016-04-26 14:33 EDT (History)
26 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A flaw was discovered where Satellite failed to properly enforce permissions on the show and delete actions for reports. An authenticated user with show or delete report permissions could use this flaw to view or delete any reports held in Foreman.
Story Points: ---
Clone Of:
Last Closed: 2015-12-15 05:53:34 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Kurt Seifried 2015-09-11 13:04:18 EDT
Dominic Cleal of the Red Hat Satellite Team reports:

Reports (from tools such as Puppet) are stored in Foreman and associated
to the host they came from. Users can be granted permissions to view
and/or destroy reports, and also separate permissions to view certain
hosts. The UI and API only list reports where the user has permission
to view both reports and the host it was from.

The security issue is that both the show and destroy actions for viewing
and deleting individual reports do not limit access to the hosts that
the user has permission to view. A user with permission to view or
destroy reports can do so for any host if they know the ID, or can
easily view the last report for a given host.

External Reference:
Comment 1 errata-xmlrpc 2015-12-15 04:19:29 EST
This issue has been addressed in the following products:

  Red Hat Satellite 6.1

Via RHSA-2015:2622 https://access.redhat.com/errata/RHSA-2015:2622

Note You need to log in before you can comment on or make changes to this bug.