Bug 1387232 – CVE-2016-8613 foreman: Stored XSS vulnerability in remote execution plugin

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1387232 - (CVE-2016-8613) CVE-2016-8613 foreman: Stored XSS vulnerability in remote execution plugin

Summary:	CVE-2016-8613 foreman: Stored XSS vulnerability in remote execution plugin

Status:	NEW

Aliases:	CVE-2016-8613

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20161024,repor...
Keywords:	Security

Depends On:	1388202 1399326
Blocks:	1387235 1432306
	Show dependency tree / graph

Reported:	2016-10-20 08:14 EDT by Andrej Nemec
Modified:	2017-03-15 00:12 EDT (History)
CC List:	11 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Andrej Nemec 2016-10-20 08:14:28 EDT

The remote execution plugin runs commands on hosts over SSH from the Foreman web UI. When a job is submitted that contains HTML tags, the console output shown in the web UI does not escape the output causing any HTML or JavaScript to run in the user's browser. The output of the job is stored, making this a stored XSS vulnerability.

Comment 1 Andrej Nemec 2016-10-20 08:14:39 EDT

Acknowledgments:

Name: Sanket Jagtap (Red Hat)

Comment 2 Andrej Nemec 2016-10-24 07:18:59 EDT

Public via:

http://projects.theforeman.org/issues/17066/

Proposed patch:

https://github.com/theforeman/foreman_remote_execution/pull/208

Comment 3 Ivan Necas 2016-10-24 14:03:10 EDT

The patch was accepted upstream, I've filed against Satellite product as https://bugzilla.redhat.com/show_bug.cgi?id=1388202 to match the issue

Note You need to log in before you can comment on or make changes to this bug.