Описание
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed execution list, enabling them to run arbitrary commands on the hosting server.
A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.
Отчет
This vulnerability is rated as having Critical impact for Red Hat Satellite because an authenticated user with minimal read-only permissions can escape the templating sandbox and achieve arbitrary code execution on the underlying Satellite host. The flaw bypasses safemode isolation when evaluating templates, allowing unauthorized methods to be invoked in the context of the Foreman application service. Because view-level permissions are commonly assigned to unprivileged accounts, exploitation does not require administrative privileges, resulting in a severe compromise of the management server.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Дополнительная информация
Статус:
EPSS
8.8 High
CVSS3
Связанные уязвимости
A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engine, an attacker can bypass the safemode sandbox isolation and execute unauthorized commands directly on the host system.
A flaw was found in Foreman. This vulnerability allows an authenticate ...
A flaw was found in Foreman. An authenticated attacker with low-level permissions can achieve remote code execution (RCE) by bypassing the safemode sandbox within the templating engine. Due to improper handling of delegated methods, an attacker can append unauthorized functions to the allowed execution list, enabling them to run arbitrary commands on the hosting server.
ALT-PU-2021-2597: package `foreman` update to version 2.5.0-alt0.1
EPSS
8.8 High
CVSS3