Plugins » Katello

The sort_by and sort_attr parameters to any controller that uses scoped_search searching are not properly sanitized and thus can be exploited to perform sql injection.

On the current release (2.4) most any api index call is vulnerable such as:

/katello/api/v2/products
/katello/api/v2/systems
/katello/api/v2/repositories

On older releases (2.3) only the errata api is affected:

/katello/api/v2/errata

An example showing the injection is:

curl -k -u admin:changeme -X GET https://`hostname`/katello/api/v2/errata?sort_by=id\&sort_order=ASC\'

{"displayMessage":"PGError: ERROR: unterminated quoted string at or near \"',

I was not able to cause an update via this exploit, as it appeared that active record was handling part of the exploit (although i may have just not been talented enough). The reporter was able to retrieve additional information from the database as a result though.