It has been discovered that redhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwrite any file, potentially gaining remote code execution.
Acknowledgments: Name: Riccardo Schirone (Red Hat Product Security)
Mitigation: If SELinux is enabled it further restricts the set of files an attacker may write to. This prevents some basic attacks that would allow to gain remote code execution, though it is not excluded other means are possible.
resultsFileName in rhcertStore.py:__saveResultsFile creates the path on the server by concatenating some fixed strings with others that can be manipulated by an attacker. In particular, when uploading a "transfer" file in /save, the clientIP is used to construct the final path, however clientIP is under the attacker's control because taken from the X-Forwarded-For HTTP header.
This issue has been addressed in the following products: Red Hat Certification for Red Hat Enterprise Linux 7 Via RHSA-2018:2373 https://access.redhat.com/errata/RHSA-2018:2373