Foreman Authorization Bypass via SSH Key Injection

Executive Summary

This vulnerability is an authorization bypass in Foreman's Api::V2::SshKeysController. It allows an attacker with the create_ssh_keys permission to inject their own public SSH key into another user's account by exploiting a missing parent-user authorization check. The injected key is then used during host provisioning, potentially granting the attacker SSH access to the victim's managed systems.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor Foreman API logs for suspicious POST requests to /api/v2/users/:user_id/ssh_keys where the user_id does not match the authenticated user. Check for unauthorized SSH key additions in user accounts by reviewing Foreman's user management interface or database queries for unexpected key entries.

Useful 0 Not Useful 0

Impact Analysis

If you are a user with the create_ssh_keys permission in Foreman, an attacker could exploit this to add their SSH key to your account. This would allow them to authenticate to and gain control over hosts you manage via SSH. The attack does not require user interaction and has low integrity impact.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to systems, potentially violating compliance requirements for data protection and access control in standards like GDPR and HIPAA. Unauthorized SSH access may result in data breaches or unauthorized modifications, impacting confidentiality and integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Apply the latest Foreman security patches or updates immediately. Temporarily restrict the create_ssh_keys permission to trusted users only. Review all SSH keys in user accounts for unauthorized additions and remove any suspicious keys. Monitor network traffic for unusual SSH access attempts from managed hosts.

Useful 0 Not Useful 0