Bug 989533 (CVE-2016-5390) - VUL-1: CVE-2016-5390: rubygem-foreman: Access to API routes beneath hosts is not filtered for users with view_host permission
Summary: VUL-1: CVE-2016-5390: rubygem-foreman: Access to API routes beneath hosts is...
Status: RESOLVED INVALID
Alias: CVE-2016-5390
Product: openSUSE.org
Classification: openSUSE
Component: 3rd party software (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Minor (vote)
Target Milestone: ---
Assignee: Stephan Kulow
QA Contact: E-mail List
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-07-19 12:03 UTC by Andreas Stieger
Modified: 2017-05-23 09:11 UTC (History)
14 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2016-07-19 12:03:02 UTC 
Courtesy bug against devel:languages:ruby:extensions/rubygem-foreman from the SUSE Security team:

http://projects.theforeman.org/issues/15653

Non-admin users with the view_hosts permission containing a filter are able to access API routes beneath "hosts" such as GET /api/v2/hosts/secrethost/interfaces without the filter being taken into account. This allows users to access network interface details (including BMC login details) for any host.

The filter is only correctly used when accessing the main host details (/api/v2/hosts/secrethost). Access to the "nested" routes, which includes interfaces, reports, parameters, audits, facts and Puppet classes, is not authorized beyond requiring any view_hosts permission.

Affects Foreman 1.10.0 and higher.

https://github.com/theforeman/foreman/pull/3644

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1355728
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-5390
Comment 1 Swamp Workflow Management 2016-07-19 22:00:36 UTC 
bugbot adjusting priority
Comment 2 Stephan Kulow 2017-05-23 09:11:15 UTC 
the gem is about http://github.com/ddollar/foreman, the CVE about https://github.com/theforeman/foreman - and we have 0.84 of the gem. So technically we are not vulnerable :)