Bug 1593764 – CVE-2018-10867 redhat-certification: /uploads/results page allows to remove files

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1593764 - (CVE-2018-10867) CVE-2018-10867 redhat-certification: /uploads/results page allows to remove files

Summary:	CVE-2018-10867 redhat-certification: /uploads/results page allows to remove f...

Status:	NEW

Aliases:	CVE-2018-10867

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20180621,repor...
Keywords:	Security

Depends On:	1608788
Blocks:	1593614
	Show dependency tree / graph

Reported:	2018-06-21 10:32 EDT by Riccardo Schirone
Modified:	2018-07-26 05:58 EDT (History)
CC List:	3 users (show)

See Also:
Fixed In Version:
Doc Type:	If docs needed, set a value
Doc Text:	It has been discovered that redhat-certification does not restrict file access in the /update/results page. A remote attacker could use this vulnerability to remove any file accessible by the user which is running httpd.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Riccardo Schirone 2018-06-21 10:32:02 EDT

Files are accessible without restrictions from the /update/results page of redhat-certification package, allowing an attacker to remove any file accessible by the apached user.

Comment 1 Riccardo Schirone 2018-06-21 10:32:11 EDT

Acknowledgments:

Name: Riccardo Schirone (Red Hat Product Security)

Comment 2 Riccardo Schirone 2018-06-21 10:32:16 EDT

Mitigation:

If SELinux is enabled, it will restrict the number of files accessible by the httpd process.

Comment 4 Riccardo Schirone 2018-06-25 09:15:06 EDT

The uploadResults view does not properly check the resultsPath, allowing any user to download existing files.

Note You need to log in before you can comment on or make changes to this bug.