Bug #14140

Arbitrary Ruby code execution via Discovery setting

Added by Lukas Zapletal over 2 years ago. Updated over 2 years ago.

Assignee:Alon Goldboim
Target version:Discovery Plugin 5.0.2
Difficulty:trivial Team Backlog:
Triaged: Fixed in Releases:
Bugzilla link: Found in Releases:
Pull request:https://github.com/theforeman/foreman_discovery/pull/260


We have couple of evals during review of new Discovery Show page:


You can run arbitrary Ruby code by entering it on the About - Settings - Discovery and then visiting a discovered host detail page where it gets rendered.

Associated revisions

Revision 7b8ac717
Added by Alon Goldboim over 2 years ago

Fixes #14099, #14140 - removed the use of eval, typos


#1 Updated by Lukas Zapletal over 2 years ago

  • Description updated (diff)

#2 Updated by Lukas Zapletal over 2 years ago

  • Status changed from New to Ready For Testing
  • Assignee changed from Lukas Zapletal to Alon Goldboim
  • Pull request https://github.com/theforeman/foreman_discovery/pull/260 added

#3 Updated by Dominic Cleal over 2 years ago

  • Private changed from Yes to No

Marking as public as it's been referenced in the associated pull request.

Lukas has also reported it to foreman-security and since this only affects the version of Discovery that's used with a release candidate version of Foreman, no CVE will be assigned as it's generally pre-release. The issue should be resolved in time for 1.11.0's release and it should be documented on http://theforeman.org/security.html.

#4 Updated by Lukas Zapletal over 2 years ago

  • Status changed from Ready For Testing to Resolved

Merged into develop and 5.0 series, bugfix release by EOBW.

Also available in: Atom PDF