Description

A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user property marked as overridable: true, the application fails to properly sanitize the effective_user input provided during the API request. Crucially, this exploitation does not rely on the content or logic of the Job Template/playbook itself; rather, the injection occurs during the instantiation of the job execution environment by the Satellite server. An attacker with permissions to execute job templates can inject arbitrary shell commands into this parameter, which are executed on the target infrastructure with the privileges of the execution user. 

Impact

An attacker with limited job execution privileges can gain full administrative control over managed hosts. By injecting malicious commands, they can bypass intended playbook restrictions, escalate privileges, and compromise the confidentiality, integrity, and availability of the entire managed infrastructure. 

Recommendations

Implement strict input validation and white-listing for the effective_user parameter to ensure it only contains valid usernames and no shell metacharacters (e.g., ;, &, |, $). 

Ensure the underlying execution engine uses safe API calls for user switching that do not involve shell evaluation of the username string.