AI analysis
A local command-injection flaw (CWE-78) exists in Foreman’s foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command, typically grep, without adequate shell neutralization, so shell metacharacters can break out of the intended command. An attacker who already has sudo permission to run this rake task can execute arbitrary code with the privileges of that command, with high impact on confidentiality, integrity, and availability beyond the task’s scope. Affected Foreman releases are not named in the provided data. There is no known public proof of concept and the issue is not listed in CISA KEV.
What to do: Limit sudo permission for the foreman-rake errors:fetch_log task to fully trusted administrators only. Apply the vendor security update for Foreman as soon as it is published, and review sudo and task logs for request_id values that contain shell metacharacters such as semicolons, quotes, or pipes.
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.