Bug 1387232 (CVE-2016-8613) - CVE-2016-8613 foreman: Stored XSS vulnerability in remote execution plugin
Summary: CVE-2016-8613 foreman: Stored XSS vulnerability in remote execution plugin
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-8613
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1388202 1399326
Blocks: 1387235 1432306
TreeView+ depends on / blocked
 
Reported: 2016-10-20 12:14 UTC by Andrej Nemec
Modified: 2021-10-21 00:55 UTC (History)
10 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-21 00:55:35 UTC
Embargoed:

Attachments (Terms of Use)

Description Andrej Nemec 2016-10-20 12:14:28 UTC 
The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. The output of the job is stored, making this a stored XSS vulnerability.
Comment 1 Andrej Nemec 2016-10-20 12:14:39 UTC 
Acknowledgments:

Name: Sanket Jagtap (Red Hat)
Comment 2 Andrej Nemec 2016-10-24 11:18:59 UTC 
Public via:

http://projects.theforeman.org/issues/17066/

Proposed patch:

https://github.com/theforeman/foreman_remote_execution/pull/208
Comment 3 Ivan Necas 2016-10-24 18:03:10 UTC 
The patch was accepted upstream, I've filed against Satellite product as https://bugzilla.redhat.com/show_bug.cgi?id=1388202 to match the issue
Note You need to log in before you can comment on or make changes to this bug.