Skip to content

Security: orrabin/theforeman.org

Security

security.md

layout title
security
Security

Security process

We take security issues seriously and welcome responsible disclosure from researchers discovering vulnerabilities in Foreman. Please email [email protected] (a private address for the security team) with all reports.

We will endeavour to resolve high severity issues in the current stable release and lower severity issues in the next major release. Announcements of security issues will be made on foreman-announce when a release containing a fix is available to end users and credit will be given to the researcher if desired.

The policy of the project is to treat all newly reported issues as private, and after evaluation, low to medium severity issues will be made public while high severity issues will be fixed under an embargo. Typically the project supports only one major (x.y) release at a time, though high severity issues may also be fixed in the previous release if it was only recently superseded.

Security advisories

All security advisories made for Foreman are listed below with their corresponding CVE identifier.

Disclosure details

CVE-2014-3531: stored cross site scripting (XSS) in operating system names

Operating system names and descriptions could store and cause evaluation of HTML in page views, allowing a cross site scripting (XSS) attack against the user.

Thanks to Jan Hutař of Red Hat for discovering this issue.

  • Affects all known Foreman versions
  • Fix released in Foreman 1.5.2
  • Redmine issue #6580
  • Red Hat Bugzilla #1108745

CVE-2014-3491: stored cross site scripting (XSS) in YAML preview

The host YAML page, used to preview the Foreman response for the Puppet ENC, will evaluate HTML stored in any host data such as parameters or comments, allowing a cross site scripting (XSS) attack against the user.

  • Affects all known Foreman versions
  • Fix released in Foreman 1.4.5 and 1.5.1
  • Redmine issue #6149
  • Red Hat Bugzilla

CVE-2014-3491: stored cross site scripting (XSS) in notification dialogs

When resources (e.g. a host group) were saved or deleted through the web UI, the name of the resource would be evaluated unsafely inside the notification popup, allowing a cross site scripting (XSS) attack against the user changing the resource.

Thanks to Adam Salah of the Red Hat Satellite 6 QE Team for discovering this issue.

  • Affects all known Foreman versions
  • Fix released in Foreman 1.4.5 and 1.5.1
  • Redmine issue #5881
  • Red Hat Bugzilla #1100313

CVE-2014-0007: TFTP boot file fetch API permits remote code execution

The Smart Proxy API for downloading boot files from installation media to the TFTP server was vulnerable to remote code execution exploits.

Thanks to Lukas Zapletal of the Red Hat Foreman Team for discovering this issue.

  • Affects all known Foreman versions
  • Fix released in Foreman 1.4.5 and 1.5.1
  • Redmine issue #6086
  • Red Hat Bugzilla

CVE-2014-0208: stored cross site scripting (XSS) in search auto-completion

The search auto-completion was vulnerable to a stored cross site scripting (XSS) attack via completion of (global/host) parameters in search keys.

Thanks to Jan Hutař of Red Hat for discovering this issue.

  • Affects all known Foreman versions
  • Fix released in Foreman 1.4.4 and 1.5.0
  • Redmine issue #5471
  • Red Hat Bugzilla #1094642

CVE-2014-0192: provisioning template previews are world-readable

Provisioning templates previews ("spoof") are accessible without authentication when used with the hostname parameter.

  • Affects Foreman 1.4.0 to 1.4.3 inclusive
  • Fix released in Foreman 1.4.4 and 1.5.0
  • Redmine issue #5436
  • Red Hat Bugzilla #1092354

CVE-2014-0135: Kafo leaves world-readable default_values.yaml file

When Kafo (used in the Foreman installer) runs, a /tmp/default_values.yaml file is written to and created with world readable permissions. This is prone to race-condition attacks and contains default values for all parameters, such as autogenerated passwords.

  • Affects all known Kafo versions
  • Fix released in Kafo 0.3.17 and 0.5.2 (to Foreman 1.4 and 1.5 repos respectively)
  • Redmine issue #4648
  • Red Hat Bugzilla #1076335

CVE-2014-0090: session fixation, new session IDs are not generated on login

Upon successful login, a new session ID was not generated for the user, so an attacker who had set the session ID in the request from the user's browser would be able to exploit the escalated session with the user's privileges.

Thanks to Jeremy Choi and Keqin Hong of the Red Hat HSS Pen-Test Team for discovering this issue.

  • Affects all known Foreman versions
  • Fix released in Foreman 1.4.2
  • Redmine issue #4457
  • Red Hat Bugzilla #1072151

CVE-2014-0089: stored cross site scripting (XSS) on 500 error page

The 500 error page was vulnerable to stored cross site scripting attacks, where the error message was rendered without HTML encoding. In addition, bookmarks could be saved by any user with HTML in the name which caused an error when rendering the bookmark list, leading to a 500 error and execution of the HTML in the browser.

Thanks to Jeremy Choi and Keqin Hong of the Red Hat HSS Pen-Test Team for discovering this issue.

  • Affects Foreman 1.4.0 to 1.4.1 inclusive
  • Fix released in Foreman 1.4.2
  • Redmine issue #4456
  • Red Hat Bugzilla #1071741

CVE-2013-4386: SQL injection in host/host group parameter overrides

Host and host group parameter overrides (lookup_values) allowed SQL injection from the host FQDN or host group label.

  • Fix released in Foreman 1.2.3
  • Redmine issue #3160
  • Red Hat Bugzilla #1013076

CVE-2013-4182: hosts API privilege escalation

The /api/hosts API was found to provide access to all hosts without checking whether the current user has privileges to view a particular host.

Thanks to Daniel Lobato Garcia of CERN IT-PES-PS for discovering this issue.

  • Fix released in Foreman 1.2.2
  • Redmine issue #2863
  • Red Hat Bugzilla #990374

CVE-2013-4180: DoS via hosts controller input conversion

Power and IPMI boot actions converted user input to symbols, which could lead to memory exhaustion.

Thanks to Marek Hulan of the Red Hat Foreman Team for discovering this issue.

  • Fix released in Foreman 1.2.2
  • Redmine issue #2860
  • Red Hat Bugzilla #989755

CVE-2013-2121: bookmarks remote code execution

Bookmarks could be created in Foreman containing data that was later executed arbitrarily when reading the bookmark.

Thanks to Ramon de C Valle of the Red Hat Product Security Team for discovering this issue.

  • Fix released in Foreman 1.2.0
  • Redmine issue #2631
  • Red Hat Bugzilla #968166

CVE-2013-2113: admin user creation, privilege escalation

Non-admin user with permissions to create or edit other users were able to change the admin flag, or assign roles that they themselves do not have, enabling a privilege escalation.

Thanks to Ramon de C Valle of the Red Hat Product Security Team for discovering this issue.

  • Fix released in Foreman 1.2.0
  • Redmine issue #2630
  • Red Hat Bugzilla #966804

CVE-2013-0210: Arbitrary command execution risk in smart proxy

Requests to the smart proxy Puppet run API were not properly escaped when running the Puppet command, leading to possible arbitrary command execution.

  • Fix released in Foreman 1.2.0

CVE-2013-0187: XMLHttpRequest bypasses authorization

XMLHttpRequest or AJAX requests to Foreman were not subject to authorization checks, enabling privilege escalation for authenticated users.

  • Fix released in Foreman 1.1

CVE-2013-0174: exposed hashed root passwords can be retrieved by unauthenticated remote users

The external node classifier (ENC) API in Foreman was accessible to any remote host and the output would contain the hashed root psasword (used for unattended installation). Authentication and authorization features were added to the ENC API to secure this data.

Thanks to Andreas Rogge for discovering this issue.

  • Fix released in Foreman 1.1
  • Redmine issue #2069

CVE-2013-0173: insecure fixed salt "foreman" for passwords

The salt used to hash root passwords (used for unattended installation) was fixed to the string "foreman" instead of being randomized.

  • Fix released in Foreman 1.1
  • Redmine issue #2069

CVE-2013-0171: import allows unauthenticated YAML uploads/parsing leading to arbitrary code execution

Fact and report import APIs in Foreman were accessible to any remote host and accepted YAML input, allowing arbitrary objects to be created on the Foreman server via YAML. Authentication and authorization features were added to the import APIs to prevent this.

  • Fix released in Foreman 1.1
  • Redmine issue #2121

CVE-2012-5648: SQL injection through search mechanism

Input to the search mechanism in Foreman was not escaped when constructing queries, enabling SQL injection into the resulting query.

  • Fix released in Foreman 1.0.2

CVE-2012-5477: world writable files in smart proxy

The smart proxy daemon ran with a umask of 0, causing files and directories written by it to have world-writable bits set. Files managed by the smart proxy could be modified by local users on the same host.

  • Fix released in Foreman 1.1
  • Redmine issue #1929

GPG keys

The Foreman project uses multiple GPG keys to sign packages and release artifacts. All stable releases will be signed by one of the keys. Nightly and plugin Debian packages will be signed, while nightly and plugin RPM packages will not (this may change in the future).

Signing for the Debian family of operating systems is via secure apt and more information, including verification steps can be found on the Debian web site. RPMs themselves are signed and can be verified using rpm --checksig PACKAGE. All yum repository configs set up by foreman-release RPMs or the installer will enable GPG checking by default.

Key management is changing at the time of writing to cycle nightly keys every two years, and issue limited duration keys per stable release.

Key ID Fingerprint Description Created Expires Revoked Notes
E775FF07 1DCB 15D1 2CA1 40EE F494 7E57 66CF 053F E775 FF07 Foreman Archive Signing Key 2010-11-10 2014-07-08 Used up to Foreman 1.5.1
1AA043B8 7059 542D 5AEA 367F 7873 2D02 B348 4CB7 1AA0 43B8 Foreman Automatic Signing Key (2014) 2014-07-01 2016-06-30

Key changes in July 2014

In July 2014 after a server was compromised, the existing GPG key (0xE775FF07) was revoked and replaced with a new key (0x1AA043B8) as a precaution. All existing packages were re-signed with the new key and thereafter, new major releases are signed with new per-release keys.

All users with the old key trusted are urged to immediately disable this as follows:

  • Debian users must run sudo apt-key del E775FF07
  • RPM users must run sudo rpm -e gpg-pubkey-e775ff07-4cda3cf9

More information is available in the announcement.

There aren’t any published security advisories