AI analysis
Foreman has OS command injection flaws (CWE-78) in the foreman-rake db:dump and db:import_dump tasks. The destination parameter used for backups and the file parameter used for imports are not sanitized before they are passed to a Ruby system() call, so an attacker who can run foreman-rake—for example via a restricted sudo rule—can append shell commands to those paths. Successful exploitation can run arbitrary commands with high impact on confidentiality, integrity, and availability; CVSS 3.1 rates it 8.2 (high) with changed scope, but it requires local access and high privileges (AV:L, PR:H) and is not an unauthenticated remote flaw. Affected version ranges are not stated in the provided data. No public proof-of-concept is known, and the CVE is not listed in the CISA KEV catalog.
What to do: Apply the vendor patch for Foreman as soon as a fixed release is available for your deployment; the provided data does not name fixed versions. Until then, restrict who can run foreman-rake (review sudoers and service accounts) and do not pass untrusted values as the db:dump destination or db:import_dump file parameters. Review those hosts for unexpected shell metacharacters in rake task arguments.
Affected
| The Foreman Project Foreman | — |
Estimated exposure
moderateOn the order of thousands to low tens of thousands of Foreman servers (estimate) — No install census or internet-scan count is in the data. The figure is an order-of-magnitude estimate from Foreman being an on-premises server lifecycle tool (often used with Red Hat Satellite), not a mass consumer product, and from the…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.