CVE-2018-1000225

Vulnerability

Cobbler versions 2.6.11 and later (possibly as early as 2.0.0) contain a stored cross-site scripting (XSS) vulnerability in cobbler-web. The XMLRPC API at /cobbler_api exposes internal methods, including _new_event, which accepts arbitrary data without sanitization. This data is later rendered in the web UI without escaping, allowing injection of JavaScript payloads [1][2][4].

Exploitation

An unauthenticated attacker with network access to the Cobbler server can send a crafted XMLRPC request to the _new_event method containing a JavaScript payload. The payload is stored and executed when an administrator or any user visits the events page in cobbler-web [1][4]. No authentication or user interaction beyond viewing the events page is required.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of an authenticated administrator's session. This can lead to session hijacking, privilege escalation to admin, and potential full compromise of the Cobbler server and managed infrastructure [1][2][4].

Mitigation

No official patch has been released as of the publication date. As a workaround, restrict network access to the /cobbler_api endpoint using a firewall to allow only trusted clients [1]. Administrators should monitor for updates from the Cobbler project [2].