CVE-2014-8168

Vulnerability

Red Hat Satellite 6.0 and later versions ship an embedded MongoDB that is not properly secured, allowing any local user on the Satellite server to connect to the MongoDB instance and access the pulp_database [1]. This flaw affects all active Satellite 6 versions [1].

Exploitation

An attacker with local shell access to the Satellite server—no elevated privileges or authentication to MongoDB required—can connect to the running MongoDB service and execute arbitrary database operations [1]. The default configuration does not enforce authentication or network restrictions for local connections [1].

Impact

A successful attacker can read, modify, or delete content within the pulp_database, which is used by the pulp component of Satellite [1]. This can lead to data integrity loss, service disruption, and potential information disclosure [1].

Mitigation

Red Hat has not released a fix for this issue as of the public references [1]. Administrators should restrict local access to the Satellite server via OS-level controls (e.g., sudo policies, file permissions, and auditing) and consider network-level isolation [1]. The issue is tracked in Red Hat Bugzilla [1].