Jeremy Choi

A flaw exists where the proxy fails to strip client-supplied identity headers on paths configured to bypass authentication via the `skip-auth-regex` setting. This allows an unauthenticated attacker to inject forged identity headers, specifically `X-Forwarded-User`, `X-Forwarded-Email`, and `X-Forwarded-Access-Token`, which are then forwarded to the upstream application.

A flaw exists where the proxy sets authenticated identity headers using dash-variant keys, such as 'X-Forwarded-User', but fails to strip underscore-variant keys, such as 'X Forwarded User', from incoming requests. Because WSGI and PHP frameworks normalize both variants to the same variable, an authenticated low-privilege user can smuggle a forged identity. This may allow the forged identity to override the legitimate authenticated identity within the upstream application.

The issue is related to missing security-related HTTP headers in Red Hat Advanced Cluster Security (RHACS), which could allow an attacker to perform a clickjacking attack. An attacker could exploit this by convincing a valid RHACS user to visit an attacker-controlled web page that deceptively points to valid RHACS endpoints, potentially hijacking the user's account permissions to perform other actions.

A Cross-Site Request Forgery (CSRF) issue was discovered, which can be exploited when preflight checks are not performed or are bypassed. This can affect authorized users using older browsers with Adobe Flash when targeted by an attacker.

A CSRF issue was found in the web console, which uses 'Basic authentication', and the REST API lacks a CSRF attack protection mechanism. This allows an attacker to obtain credentials and the Authorization: header when requesting the REST API via a web browser.

The issue is related to shell command injection flaws in Openshift, caused by unsanitized data being passed into shell commands.

The issue allows the API to be used for creating applications via cartridge cache.rb, where the `URI.prase()` function can be exploited to perform command injection.

The issue concerns a problem where the OpenShift cartridge allows remote URL retrieval.

The issue is related to the configuration of Syndesis, specifically with Cross-Origin Resource Sharing (CORS) set to allow all origins, which could be exploited by an attacker to conduct phishing attacks and gain unauthorized access to information. Additionally, there is a vulnerability related to insufficient input validation, which could allow an attacker to obtain unauthorized access to protected information.

Name of the Vulnerable Software and Affected Versions: Perl Crypt::JWT versions prior to 0.023 Description: The issue allows attackers to bypass authentication by providing a crafted token using the hmac() function. This is due to incorrect access control in the JWT.pm component, specifically at line 614. The attack vector is through network connectivity. Recommendations: For versions prior to 0.023, update to a version after commit b98a59b42ded9f9e51b2560410106207c2152d6c to resolve the issue. As a temporary workaround, consider restricting network connectivity to minimize the risk of exploitation.

The issue allows remote attackers to perform a reflected XSS attack via dashbuilder. This can be achieved by enticing authenticated users, typically admins, to click on malicious links to the /dashbuilder/Controller endpoint, which contains malicious scripts. Successful exploitation enables the execution of script code within the context of the affected user.

The issue allows remote attackers to post data as any username in the logbook.

A cross-site request forgery issue allows remote attackers to hijack user authentication for requests that modify instances via a crafted web page.

The issue concerns the web console in Red Hat JBoss Operations Network (JON) that does not properly authorize requests to add users with the super user role. This allows remote authenticated users to gain admin privileges via a crafted POST request to an unspecified API endpoint.

The issue concerns the dashbuilder component in Red Hat JBoss BPM Suite, which fails to properly handle CSRF tokens. This allows remote attackers to bypass CSRF protection mechanisms or conduct cross-site request forgery attacks by obtaining an old token.

The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the admin pages of dashbuilder. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unspecified vectors.

The issue makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies, as the HTTPOnly flag is not included in a Set-Cookie header for session cookies.

The issue allows remote attackers to hijack web sessions. This is achieved via the session id cookie.

A cross-site scripting (XSS) issue allows remote authenticated users to inject arbitrary web script or HTML via the bookmark name when adding a bookmark.