CVE-2021-3457

Vulnerability

The smart_proxy_shellhooks plugin for Foreman's smart-proxy contains an improper authorization handling flaw [1]. This allows any Foreman client (authenticated user) to execute actions that are intended to be limited to the Foreman Server itself [1]. The affected component is the Shellhooks plugin as used in upstream Foreman; Red Hat Satellite 6 does not ship this plugin and is not vulnerable [1]. The exact versions affected are not specified in the available references.

Exploitation

An authenticated local attacker can exploit this flaw by sending requests to the smart-proxy that invoke Shellhooks operations [1]. The attacker does not need special privileges beyond being a valid Foreman client [1]. No detailed exploitation steps are disclosed in the references.

Impact

Successful exploitation allows the attacker to access and delete limited resources on the Foreman server, and also causes a denial of service (DoS) on the Foreman server [1]. The highest threat is to integrity and system availability [1].

Mitigation

As a mitigation, disable the smart_proxy_shellhooks plugin on the Foreman server [1]. A fixed version of the plugin has not been announced in the available references; users should monitor the Foreman project for updates. Red Hat Satellite 6 is not affected [1].