AI analysis
Foreman’s foreman-tail utility has an OS command injection flaw (CWE-78) caused by passing unsanitized user arguments into a string that eval executes to expand file paths. A local attacker who can already run the utility with low privileges can insert shell metacharacters such as ;, &, or | and run arbitrary system commands. Impact is limited to low confidentiality, integrity, and availability on the local host (CVSS 3.1 base score 5.3; local attack, low privileges, no user interaction). Organizations running Foreman releases before the 3.19.2 and 5.0.1 fixes are affected. There is no known public proof of concept and the issue is not listed in CISA KEV.
What to do: Upgrade Foreman to 3.19.2 or 5.0.1 (or a later release on the same branch). Until then, limit which local accounts can run foreman-tail and treat unexpected shell metacharacters in its arguments as suspicious.
Affected
| Foreman Project Foreman | Releases fixed in 3.19.2 and 5.0.1; earlier versions on those lines are affected |
Estimated exposure
moderateLow thousands to tens of thousands of installations (order-of-magnitude estimate) — Foreman is a widely used open-source Linux lifecycle manager (upstream of products such as Red Hat Satellite). Most installs are internal; public scans usually show only low thousands of internet-reachable web UIs, and no vendor install…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.