[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAKG8Do5TnCQtc=o7Z1mkk94_gM9LbFywkrt218a0NpeL1a=9wA@mail.gmail.com>
Date: Thu, 9 Aug 2018 17:42:39 +0200
From: Cedric Buissart <cbuissar@...hat.com>
To: oss-security@...ts.openwall.com
Subject: cobbler CVE-2018-10931: CobblerXMLRPCInterface exports internal only
functions over XMLRPC
Cobbler is a Linux installation server that allows for rapid setup of
network
installation environments. It is used in products like Red Hat Enterprise
Satellite 5 and Spacewalk. Upstream project is at :
https://cobbler.github.io/
While diagnosing the following 2 flaws :
https://movermeyer.com/2018-08-02-privilege-escalation-exploits-in-cobblers-api/
Another flaw has been found: cobbler exposes all functions from its
CobblerXMLRPCInterface class over XMLRPC. However, python renames the __*
function with _<classname>__<functionname>. A remote, unauthenticated
attacker
could use this flaw by calling the real name of any __* function and gain
high
privileges within cobbler or upload files to arbitrary location in the
context
of the daemon. This is identified as CVE-2018-10931
All versions of cobbler (at least since 2.0.7) are affected.
To reproduce the issue: use the reproducers from the report above and call
any
__<name> function as _CobblerXMLRPCInterface__<name>
The patch for this specific vulnerability (i.e.: it does *not* fix the
vulnerability reported by movermeyer.com) :
---
cobbler/remote.py | 3 +++
1 file changed, 3 insertions(+)
diff --git a/cobbler/remote.py b/cobbler/remote.py
index 94a18e7..ea0e354 100644
--- a/cobbler/remote.py
+++ b/cobbler/remote.py
@@ -1752,6 +1752,9 @@ class ProxiedXMLRPCInterface:
def _dispatch(self, method, params, **rest):
+ if method.startswith('_'):
+ raise CX("forbidden method")
+
if not hasattr(self.proxied, method):
raise CX("unknown remote method")
---
Best regards,
--
Cedric Buissart,
Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
