CVE-2018-10917

Vulnerability

Pulp versions 2.16.x (and possibly older) contain an improper path parsing vulnerability in the ISO repository handling code. The issue allows a malicious user with repository write access, or a malicious ISO feed repository, to inject crafted paths that bypass normal path validation. This enables writing files to arbitrary directories accessible to the 'apache' user on the Pulp server [1][2][3][4].

Exploitation

An attacker must have valid credentials to write to a Pulp ISO repository, or be able to supply a malicious ISO feed repository that Pulp syncs from. The attacker crafts an ISO feed or file metadata with path elements (such as ../) that are not properly sanitized. When Pulp processes the feed, it writes content to a location on the filesystem outside of the intended repository storage directory [4].

Impact

Successful exploitation allows the attacker to write arbitrary files to paths writable by the 'apache' user. This can lead to overwriting published content of other ISO repositories, potentially altering or replacing trusted software packages. The attacker may also be able to place malicious files that could be served to users, leading to further compromise [4].

Mitigation

A fix is included in Red Hat Satellite 6.5 (errata RHSA-2019:1222) and Red Hat Enterprise Linux 7 (errata RHEA-2019:1283). Users should upgrade to the patched versions of Pulp (2.16.x after the fix) provided in these errata. There is no known workaround; the recommended mitigation is to apply updates immediately [1][2].