Laura Pardo

The `foreman-tail` utility is susceptible to OS command injection resulting from the unsafe implementation of the `eval` command. The script incorporates user-supplied arguments into a string executed by `eval` to expand file paths without proper sanitization or quoting. This allows a local attacker to use shell metacharacters such as `;`, `&`, or `|` to execute arbitrary system commands.

An authentication bypass exists in the '/unattended/provision' API endpoint due to a semantic logic flaw in `host verifier.rb`. The application checks the database state of a provisioning token instead of verifying its presence in the incoming HTTP request. Consequently, if a host is actively undergoing provisioning and has an unexpired token in the database, the `valid host token?()` method returns true, allowing access to the kickstart template even when no token is provided in the URL.

OS command injection flaws exist in the `foreman-rake db:dump` and `db:import dump` tasks. The application does not properly sanitize user-supplied input in the `destination` parameter during backups and the `file` parameter during imports before passing them to a Ruby `system()` call for execution. An attacker with permissions to execute `foreman-rake`, such as through a restricted sudo configuration, can append malicious shell commands to the provided file paths.

Command injection is possible in Hammer CLI and the Railties (Ruby on Rails) component distributed with Satellite. The issue occurs because the `$EDITOR` environment variable is insecurely interpolated into the Ruby `system()` function. When a single interpolated string is passed to `system()`, the application invokes a system shell (/bin/sh) that interprets shell metacharacters such as `;`, `|`, and `&`.

A command injection flaw exists in the Red Hat Satellite API endpoint '/api/v2/job invocations'. The issue occurs when a job template has the `effective user` property set to overridable: true, as the application does not properly sanitize the `effective user` input during the API request. This allows an attacker with permissions to execute job templates to inject arbitrary shell commands into the `effective user` parameter, which are then executed on the target infrastructure with the privileges of the execution user. The injection happens during the instantiation of the job execution environment by the Satellite server and is independent of the Job Template or playbook logic.

A command injection flaw exists in the `foreman-rake errors:fetch log` task. The `request id` parameter is passed to an underlying system command, typically `grep`, without adequate shell neutralization. An attacker with sudo permissions to execute this rake task can inject shell metacharacters, such as `;`, `"`, or `|`, to bypass the intended command and execute arbitrary code.

A flaw exists in the `foreman-rake` initialization logic located in `/usr/share/foreman/config/settings.rb`. The issue stems from a code pattern where configuration data is processed through two separate executable layers, creating a multi-stage execution chain. This allows for Server-Side Template Injection (SSTI)—where an attacker injects malicious templates that are executed on the server—and insecure deserialization—where untrusted data is used to abuse the logic of an application to execute arbitrary code. This can result in remote code execution, total infrastructure compromise, and supply chain risk.

An SQL injection issue exists in the Red Hat Satellite Katello Registry Proxy due to improper sanitization of input parameters used in database queries within the `RegistryProxiesController`. Specifically, the functions `check blob push org label()` and `get matching products from org()` take user-supplied labels from the request path and interpolate them into raw SQL fragments. This allows a user with only the `create personal access tokens` permission to exploit the flaw, regardless of whether they have an assigned Organization or Location.

An authorization bypass exists in the `RegistryProxiesController` within Katello due to an execution fall-through in the `registry authorize` filter. Although the application detects unauthorized requests and triggers an error response via the `unauthorized()` function, it fails to halt the execution of the current code path because of a missing return statement. This control flow failure allows the application to continue into business logic and database validation filters, revealing internal state through differential responses. An unprivileged attacker can exploit this to enumerate valid Users, Organizations, and Products across the instance.

A flaw exists in the container group `pod spec override` field due to an incomplete blocklist that only restricts `automountServiceAccountToken`. This allows the injection of `initContainers`, `serviceAccountName` overrides, and projected service account token volumes. An AAP platform administrator can exploit this to escalate privileges to OpenShift namespace-level access and exfiltrate namespace secrets.

An issue exists where the extension insecurely stores the Google Gemini API key in plain text within the user configuration file and writes it to output log files. This allows a local attacker or malware running with user privileges to read the API key, potentially leading to unauthorized use of the user's API quota.

A command injection flaw exists in the `AnsiblePlaybookRunProvider`. An attacker can craft a malicious playbook filename containing special characters that are not properly sanitized. When the playbook is executed, it allows for the execution of arbitrary code with the privileges of the user running VS Code, potentially leading to full system compromise, sensitive data exfiltration, modification of project files, and permanent data loss.

An issue exists due to improper handling of the `ansible.executionEnvironment.containerOptions` and `ansible.executionEnvironment.volumeMounts` settings, which allows the injection of shell separators. This can be triggered automatically during Language Server initialization or manually when executing a playbook. Successful exploitation enables remote code execution (RCE) on the victim's machine with the privileges of the Visual Studio Code user, potentially leading to a complete system compromise.

A command injection flaw exists where the extension fails to properly validate user input as a file path within the `ansible.python.activationScript` setting. This setting is intended for virtual environment activation scripts. A remote attacker can exploit this by inducing a user to open or execute a specially crafted project, allowing the execution of unauthorized commands with the privileges of the Visual Studio Code application.

A path traversal flaw exists in the Ansible Lightspeed Model Context Protocol (MCP) server. This issue allows an attacker to manipulate an AI agent via indirect prompt injection, which is a technique where malicious instructions are embedded in data that the AI processes. This manipulation can force the server to write files to unauthorized locations on the user's system, potentially exposing sensitive host information and allowing the execution of malicious commands, which could lead to a full system compromise.

Two distinct logging mechanisms in the software can expose sensitive session and authentication data. One mechanism logs session identifiers, which function as authentication credentials, at an informational level. A second mechanism, active when debug logging is enabled, fails to completely sanitize HTTP request headers, resulting in the cleartext logging of API keys and authorization tokens. This leads to a confidentiality breach where sensitive data is stored in plain text within container logs, which increases risk if logs are sent to a centralized platform.

A session management issue in the MCP Server allows unauthenticated attackers to hijack active administrative sessions. This occurs because the server improperly caches authenticated client connections, trusts non-secret session IDs without re-validating authentication tokens, and logs newly created session IDs to standard logs. Successful exploitation can lead to privilege escalation and infrastructure-wide code execution.

An issue exists due to insufficient session expiration, allowing a remote attacker to maintain persistent access to the instance. If a valid OAuth (Open Authorization) access token is exfiltrated before a user logs out, the attacker can continue to authenticate and access sensitive data. This occurs because the application does not invalidate the token on the backend, leaving it active until its natural expiration. This can result in unauthorized read access to resources such as inventories, playbooks, and configuration data.

The Ansible Lightspeed API conversation endpoints, which manage AI chat interactions, do not adequately confirm if a conversation identifier corresponds to the authenticated user. This allows an attacker with valid credentials to access or modify conversations belonging to other users, potentially exposing sensitive data and enabling unauthorized manipulation of AI-generated outputs. The affected API endpoints are conversation endpoints. The vulnerable parameter is the conversation identifier.

A flaw was found in http-proxy-agent where it passes an auth option to the Buffer constructor without proper sanitization. This could result in a Denial of Service through the usage of all available CPU resources and data exposure through an uninitialized memory leak in setups where an attacker could submit typed input to the `auth` parameter.