Bug 989005 - (CVE-2014-3593) CVE-2014-3593 luci: privilege escalation through cluster with specially crafted configuration
CVE-2014-3593 luci: privilege escalation through cluster with specially craft...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
Unspecified Unspecified
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20141014,repor...
: Security
Depends On: 1127286
Blocks: 990750 1101912
  Show dependency treegraph
 
Reported: 2013-07-26 17:42 EDT by Jan Pokorný
Modified: 2015-07-31 06:59 EDT (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
It was discovered that luci used eval() on inputs containing strings from the cluster configuration file when generating its web pages. An attacker with privileges to create or edit the cluster configuration could use this flaw to execute arbitrary code as the luci user on a host running luci.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-10-14 05:30:41 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Comment 7 Vincent Danen 2013-08-08 15:56:00 EDT
It was found that luci was vulnerable to an arbitrary code execution flaw due to the use of the "eval" Python construct used on the web page templating level.  An authenticated user could use this flaw to execute arbitrary code as the system-wide luci user or to elevate their privileges within luci and/or the managed cluster.

An unchecked argument originating from the configuration file of the currently-selected cluster, and fetched from one of its nodes, could appear in the "eval" construct.  As such, a user with the create_cluster or import_cluster roles, could create a crafted cluster.conf to take advantage of this flaw.

Acknowledgements:

This issue was discovered by Jan Pokorný of Red Hat.
Comment 23 Martin Prpič 2014-10-06 04:13:51 EDT
IssueDescription:

It was discovered that luci used eval() on inputs containing strings from the cluster configuration file when generating its web pages. An attacker with privileges to create or edit the cluster configuration could use this flaw to execute arbitrary code as the luci user on a host running luci.
Comment 24 errata-xmlrpc 2014-10-14 00:12:40 EDT
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2014:1390 https://rhn.redhat.com/errata/RHSA-2014-1390.html

Note You need to log in before you can comment on or make changes to this bug.