Bug 1873926 (CVE-2020-14380) - CVE-2020-14380 Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover
Summary: CVE-2020-14380 Satellite: Local user impersonation by Single sign-on (SSO) us...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-14380
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1873439 1873933
Blocks: 1873914
TreeView+ depends on / blocked
 
Reported: 2020-08-31 03:57 UTC by Yadnyawalk Tale
Modified: 2021-12-14 18:47 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Red Hat Satellite's external authentication component is vulnerable to a full account takeover flaw. This flaw allows an attacker with an authenticated account on Single sign-on (SSO) to gain elevated privileges of existing local users. This issue only affects users who have configured Satellite to use Apache SSO or Open ID Connect external authentication sources, and that have not disabled the auto-creation of users on login. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Clone Of:
Environment:
Last Closed: 2020-10-27 14:21:55 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:4366 0 None None None 2020-10-27 12:57:18 UTC

Description Yadnyawalk Tale 2020-08-31 03:57:56 UTC 
A account takeover flaw was found in Red Hat Satellite 6.7.2 onward, a potential attacker with proper authentication to the relevant external authentication source (SSO or Open ID) can claim the privileges of already existing local users of Satellite.
Comment 4 Yadnyawalk Tale 2020-09-01 03:49:39 UTC 
Acknowledgments:

Name: Stefan Meyer (Red Hat)
Comment 5 RaTasha Tillery-Smith 2020-09-01 14:40:32 UTC 
Mitigation:

This issue can be mitigated by disabling the external login if a Satellite user has their authentication set to INTERNAL.
Comment 6 wclark 2020-09-03 14:07:55 UTC 
Hotfixes for this issue are available for Satellite 6.7.2 and Satellite 6.7.3

To obtain the Hotfix for your Satellite version, please open a support case with Red Hat Technical Support, as the Hotfix RPM is too large to be provided as a bugzilla attachment

INSTALLATION INSTRUCTIONS:

(Both versions)
1. Make a backup or snapshot or Satellite server

(Both versions)
2. Obtain the Hotfix RPM from Red Hat Technical Support and copy it to Satellite server

(Satellite 6.7.2)
3. # rpm -Uvh --nodeps foreman-1.24.1.24-3.HOTFIXRHBZ1798489RHBZ1792135RHBZ1873439.el7sat.noarch.rpm

(Satellite 6.7.3)
3. # rpm -Uvh --nodeps foreman-1.24.1.25-2.HOTFIXRHBZ1798489RHBZ1792135RHBZ1873439.el7sat.noarch.rpm

(Both versions)
4. # satellite-maintain service restart
Comment 8 errata-xmlrpc 2020-10-27 12:57:17 UTC 
This issue has been addressed in the following products:

  Red Hat Satellite 6.7 for RHEL 8

Via RHSA-2020:4366 https://access.redhat.com/errata/RHSA-2020:4366
Comment 9 Product Security DevOps Team 2020-10-27 14:21:55 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-14380
Note You need to log in before you can comment on or make changes to this bug.