Bug 2221928 - Satellite: CSRF Enabled by Attacker Exploiting API Session Cookie via User's Kerberos Ticket
Summary: Satellite: CSRF Enabled by Attacker Exploiting API Session Cookie via User's ...
Keywords:
Status: NEW
Alias: None
Product: Security Response
Classification: Other
Component: weakness
Version: unspecified
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2168153
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-07-11 10:11 UTC by Yadnyawalk Tale
Modified: 2023-07-18 09:38 UTC (History)
11 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description Yadnyawalk Tale 2023-07-11 10:11:38 UTC
Description:
A security regression was discovered during the testing of an upcoming feature in Satellite 6.13, which allows the usage of Kerberos for CLI and API. Although this may be considered a feature rather than a bug, it introduces a new attack vector through CSRF. 

The issue allows an attacker to obtain an API session cookie in a browser, even if the user has never logged into the Satellite or entered their credentials. The only prerequisite is that the user has a Kerberos Ticket Granting Ticket (TGT) obtained through 'kinit'. With this API session cookie, the attacker can perform CSRF attacks against the API, bypassing CSRF protection and carrying out malicious actions under the user's name, without formal consent of the user.

Impacted Satellite Version:
6.13


Note You need to log in before you can comment on or make changes to this bug.