Bug 989005 (CVE-2014-3593) - CVE-2014-3593 luci: privilege escalation through cluster with specially crafted configuration
Summary: CVE-2014-3593 luci: privilege escalation through cluster with specially craft...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-3593
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1127286
Blocks: 990750 1101912
TreeView+ depends on / blocked
 
Reported: 2013-07-26 21:42 UTC by Jan Pokorný [poki]
Modified: 2021-02-17 07:29 UTC (History)
7 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
It was discovered that luci used eval() on inputs containing strings from the cluster configuration file when generating its web pages. An attacker with privileges to create or edit the cluster configuration could use this flaw to execute arbitrary code as the luci user on a host running luci.
Clone Of:
Environment:
Last Closed: 2014-10-14 09:30:41 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:1390 0 normal SHIPPED_LIVE Moderate: luci security, bug fix, and enhancement update 2014-10-14 08:11:39 UTC

Comment 7 Vincent Danen 2013-08-08 19:56:00 UTC
It was found that luci was vulnerable to an arbitrary code execution flaw due to the use of the "eval" Python construct used on the web page templating level.  An authenticated user could use this flaw to execute arbitrary code as the system-wide luci user or to elevate their privileges within luci and/or the managed cluster.

An unchecked argument originating from the configuration file of the currently-selected cluster, and fetched from one of its nodes, could appear in the "eval" construct.  As such, a user with the create_cluster or import_cluster roles, could create a crafted cluster.conf to take advantage of this flaw.

Acknowledgements:

This issue was discovered by Jan Pokorný of Red Hat.

Comment 23 Martin Prpič 2014-10-06 08:13:51 UTC
IssueDescription:

It was discovered that luci used eval() on inputs containing strings from the cluster configuration file when generating its web pages. An attacker with privileges to create or edit the cluster configuration could use this flaw to execute arbitrary code as the luci user on a host running luci.

Comment 24 errata-xmlrpc 2014-10-14 04:12:40 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2014:1390 https://rhn.redhat.com/errata/RHSA-2014-1390.html


Note You need to log in before you can comment on or make changes to this bug.