Bug #32753: CVE-2021-3584: Remote code execution through Sendmail configuration - Foreman

Bug #32753

CVE-2021-3584: Remote code execution through Sendmail configuration

Added by Lukas Zapletal almost 2 years ago. Updated almost 2 years ago.

Status:

Closed

Priority:

High

Assignee:

Lukas Zapletal

Category:

Settings

Target version:

2.5.1

Difficulty:

easy

Triaged:

Yes

Bugzilla link:

1968443

Pull request:

https://github.com/theforeman/foreman/pull/8599

Fixed in Releases:

2.4.1, 2.5.1, 3.0.0

Found in Releases:

1.15.0

Red Hat JIRA:

Description

Sendmail location and arguments, available via Administer - Settings,
both accept arbitrary strings and pass them into shell.
By default, only Foreman super administrator can access settings.

Mitigation: Verify the both settings and remove edit_settings
permissions to all roles and users until fixed. Alternatively, create
settings named sendmail_location and sendmail_arguments in settings.yaml
file to override the UI and make the values read-only.

Solution: Limit the possible values for location to just expected paths.
Use shellescaping for arguments as there is currently no way to pass
arguments to the 'mail' gem in a safely manner.

sendmail-32753-a.patch	sendmail-32753-a.patch	3.38 KB		Lukas Zapletal, 06/09/2021 06:57 AM
sendmail-32753-b.patch	sendmail-32753-b.patch	4.52 KB		Lukas Zapletal, 06/10/2021 01:32 PM

Related issues

Associated revisions

Revision c83d799e (diff)
Added by Lukas Zapletal almost 2 years ago

Fixes #32753 - Remote code execution through Sendmail

CVE-2021-3584: Sendmail location and arguments, available via Administer
- Settings, both accept arbitrary strings and pass them into shell.
By default, only Foreman super administrator can access settings.

Solution: Limit the possible values for location to just expected paths.
Use shellescaping for arguments as there is currently no way to pass
arguments to the 'mail' gem in a safely manner.