Bug 2317450 (CVE-2024-6861) - CVE-2024-6861 foreman: foreman: OAuth secret exposure via unauthenticated access to the GraphQL API
Summary: CVE-2024-6861 foreman: foreman: OAuth secret exposure via unauthenticated acc...
Keywords:
Status: NEW
Alias: CVE-2024-6861
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-10-09 00:42 UTC by OSIDB Bzimport
Modified: 2024-10-09 05:28 UTC (History)
8 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2024-10-09 00:42:19 UTC 
A flaw was found in foreman before version 3.3. The server exposes a GraphQL API with limited access. If introspection is enabled (usually by default), it allow attackers to query a settings type without any authentication and retrieve the product settings, including the OAuth consumer_key and OAuth consumer_secret properties. These elements can be used to authenticate as foreman_api_admin and gain full control of the product's REST API.
Note You need to log in before you can comment on or make changes to this bug.