Foreman vulnerabilities

The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory.

In Foreman before 6.2, when the SSH service is enabled on discovered nodes, discovery-debug displays the root password in plaintext in the system journal during login.

Foreman versions from 1.1 to before 1.9.0-RC1 do not redirect HTTP requests to HTTPS when the require_ssl setting is enabled. This allows remote attackers to obtain user credentials via a man-in-the-middle attack.

Foreman since version 1.5 is vulnerable to an incorrect authorization check, allowing users with user management permissions assigned to certain organizations to perform all operations granted by these permissions on administrator user objects outside their scope.

The Organization and Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions, enabling (a) reading, (b) editing, or (c) deleting arbitrary organizations or locations.

The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands.

Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API.

Multiple SQL injection vulnerabilities in Foreman before 1.0.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters in search.rb or puppetclass.rb, related to the search mechanism.

A flaw in Foreman allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. The user can access sensitive data such as host root passwords. Under insecure configurations with Safemode disabled, the flaw may also allow arbitrary command execution as the Foreman system account.

A flaw in Foreman allows an authenticated attacker with low-level permissions to achieve remote code execution (RCE) by bypassing the Safemode sandbox within the templating engine. Due to improper handling of delegated methods, the attacker can append unauthorized functions to the allowed execution list, enabling arbitrary command execution on the hosting server.

An incorrect authorization flaw has been found in network interface handling in the Foreman package. The domain and subnet interface API checks only that the caller holds a host permission, but does not apply the search limit on that permission. A low-privileged attacker can read interfaces of hosts they are not allowed to view, and if they have edit permissions, they can modify those interfaces.

A flaw has been found in permission filters in the foreman package. The API loads a filter by its identifier and does not apply the search limit on the caller's permission. A low-privileged attacker who is allowed to delete filters for one role only can delete filters belonging to other unlocked roles, leading to loss of access to resources.

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.

A flaw was found in Foreman's foreman-rake initialization logic in /usr/share/foreman/config/settings.rb, where configuration data is processed through two distinct executable layers. This enables Server-Side Template Injection (SSTI) and insecure deserialization, potentially leading to remote code execution.

OS command injection vulnerabilities exist in Foreman's foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call.

A command injection vulnerability exists in Foreman's foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization.

The Red Hat Satellite /unattended/provision API endpoint in Foreman is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request.

Foreman template revision endpoint lacks object-level authorization. A low-privileged user can retrieve historical template contents from another organization or location.

A flaw was found in Foreman that allows authenticated users with 'view_keypairs' permission to download private SSH keys from other organizations by directly querying key pair IDs. This vulnerability bypasses taxonomy scoping, leading to cross-tenant data exposure in multi-tenant deployments.

A flaw was found in Foreman that allows cross-tenant information disclosure. An authenticated user with host-edit permissions can bypass authorization checks and leak sensitive infrastructure metadata from other organizations.

A flaw was found in Foreman where a broken access control vulnerability allows an authenticated user with host-edit permissions to retarget an existing lookup value override to a different host by modifying the match field through nested host attributes, bypassing authorization checks.

The Usergroup model in Foreman does not properly validate role assignments against the calling user's permissions. This allows an authenticated user with usergroup management permissions to attach arbitrary roles, including administrative roles, to a user group and then add themselves as a member.

A flaw has been found in Foreman where HTTP parameters can be modified in http_proxies_controller and http_proxy files. Attackers can perform an SSRF attack and steal cloud metadata service on AWS, GCP, or Azure environments.

A command injection vulnerability was found in Foreman's WebSocket proxy implementation. A remote attacker can exploit unsanitized hostname values from compute resource providers to execute arbitrary code on the Foreman server.