CVE-2018-16887

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the katello component of Red Hat Satellite, affecting versions before 3.9.0 [2]. The flaw is located in the Subscriptions and Red Hat Repositories wizards, where an attacker with the privilege to create or edit organizations and locations can inject malicious scripts [2][3].

Exploitation

An attacker must have the ability to create or edit organizations and locations within Satellite. They can then craft malicious input within the Subscriptions or Red Hat Repositories wizards. When other users, including higher-privileged users, access these pages, the injected script executes in the context of their browser session [2][3].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the victim's browser, potentially leading to theft of the anti-CSRF token of higher-privileged users. This could enable further attacks such as session hijacking or privilege escalation [2].

Mitigation

The vulnerability is fixed in Red Hat Satellite 6.5, which includes katello version 3.10.0 [1]. Users should upgrade to this or later version. No workarounds are available. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV).