AI analysis
A command-injection flaw (CWE-78) in rubygem-foreman_remote_execution affects the Red Hat Satellite API at /api/v2/job_invocations. When a job template marks effective_user as overridable, the server does not properly sanitize the effective_user value from the API request; the injection occurs while Satellite instantiates the job execution environment, not inside the job template or playbook. An attacker who can already run job templates can inject arbitrary shell commands that execute on target systems with the privileges of the execution user, with high impact to confidentiality, integrity, and availability (CVSS 3.1 8.8, network, low privileges). Organizations running Red Hat Satellite or Foreman remote execution with overridable effective_user templates are affected. No public proof-of-concept is known and the issue is not in CISA KEV.
What to do: Apply the vendor security update for rubygem-foreman_remote_execution and Red Hat Satellite as soon as it is available for your release; no fixed version is named in the advisory data. Until patched, restrict which accounts can invoke job templates, avoid marking effective_user as overridable, and review recent /api/v2/job_invocations calls for unexpected effective_user values.
Affected
| Red Hat Satellite (rubygem-foreman_remote_execution) | — |
| The Foreman Project foreman_remote_execution | — |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user property marked as overridable: true, the application fails to properly sanitize the effective_user input provided during the API request. The exploitation does not rely on the content or logic of the Job Template/playbook itself; rather, the injection occurs during the instantiation of the job execution environment by the Satellite server. An attacker with permissions to execute job templates can inject arbitrary shell commands into this parameter, which are executed on the target infrastructure with the privileges of the execution user.