CVE-2017-7535

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in Foreman versions before 1.16.0 in the organization/location assignment page for hosts. An attacker can inject arbitrary HTML or JavaScript into an organization's name; this malicious payload is then stored and executed when a user subsequently assigns a host to that organization [1].

Exploitation

Exploitation requires an attacker to have the ability to create or modify an organization's name (e.g., via the administration interface) and to include HTML/script code in that name. When another user (with host assignment privileges) visits the manage organization page and selects that organization for a host, the stored payload executes in the context of the victim's browser session [1][2]. No further user interaction beyond the assignment action is needed.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's Foreman session. This can lead to session hijacking, data exfiltration, or further administrative actions within the Foreman interface, depending on the victim's privileges [1].

Mitigation

The vulnerability is fixed in Foreman version 1.16.0 and later. Users should upgrade to that version or newer. For earlier versions, no official workaround is documented; administrators should restrict organization name creation to trusted users and audit existing organization names for malicious content [1][2].