pysec - pysec-2022-177

pysec-2022-177

Vulnerability from pysec

Published

2022-03-11 13:15

Modified

2022-04-11 00:47

Details

Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.

Impacted products

Name	purl
cobbler	pkg:pypi/cobbler

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "cobbler",
        "purl": "pkg:pypi/cobbler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9044aa990a94752fa5bd5a24051adde099280bfa"
            }
          ],
          "repo": "https://github.com/cobbler/cobbler",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.6.3-2",
        "3.1.2",
        "3.2.1",
        "3.2.2",
        "3.3.0",
        "3.3.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2022-0860",
    "GHSA-mcg6-h362-cmq5"
  ],
  "details": "Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.",
  "id": "PYSEC-2022-177",
  "modified": "2022-04-11T00:47:24.533946Z",
  "published": "2022-03-11T13:15:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/c458b868-63df-414e-af10-47e3745caa1d"
    },
    {
      "type": "FIX",
      "url": "https://github.com/cobbler/cobbler/commit/9044aa990a94752fa5bd5a24051adde099280bfa"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DYWYHWVVRUSPCV5SWBOSAMQJQLTSBTKY/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYSHMF6MEIITFAG7EJ3IQKVUN7MDV2XM/"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D4KCNZYBQC2FM5SEEDRQZO4LRZ4ZECMG/"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-mcg6-h362-cmq5"
    }
  ]
}

CVE-2022-0860 (GCVE-0-2022-0860)

Vulnerability from cvelistv5

Published

2022-03-11 12:50

Modified

2024-08-02 23:40

Severity ?

8.2 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

CWE

CWE-285 - Improper Authorization

Summary

Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.

References

URL

Tags

	https://huntr.dev/bounties/c458b868-63df-414e-af10-47e3745caa1d	x_refsource_CONFIRM
	https://github.com/cobbler/cobbler/commit/9044aa990a94752fa5bd5a24051adde099280bfa	x_refsource_MISC
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYWYHWVVRUSPCV5SWBOSAMQJQLTSBTKY/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4KCNZYBQC2FM5SEEDRQZO4LRZ4ZECMG/	vendor-advisory, x_refsource_FEDORA
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYSHMF6MEIITFAG7EJ3IQKVUN7MDV2XM/	vendor-advisory, x_refsource_FEDORA

Impacted products

	Vendor	Product	Version
	cobbler	cobbler/cobbler	Version: unspecified < 3.3.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:40:04.519Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/c458b868-63df-414e-af10-47e3745caa1d"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/cobbler/cobbler/commit/9044aa990a94752fa5bd5a24051adde099280bfa"
          },
          {
            "name": "FEDORA-2022-224e71968f",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYWYHWVVRUSPCV5SWBOSAMQJQLTSBTKY/"
          },
          {
            "name": "FEDORA-2022-445ec90e7c",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4KCNZYBQC2FM5SEEDRQZO4LRZ4ZECMG/"
          },
          {
            "name": "FEDORA-2022-ad2b0ad61b",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYSHMF6MEIITFAG7EJ3IQKVUN7MDV2XM/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cobbler/cobbler",
          "vendor": "cobbler",
          "versions": [
            {
              "lessThan": "3.3.2",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-31T02:06:16",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/c458b868-63df-414e-af10-47e3745caa1d"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/cobbler/cobbler/commit/9044aa990a94752fa5bd5a24051adde099280bfa"
        },
        {
          "name": "FEDORA-2022-224e71968f",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYWYHWVVRUSPCV5SWBOSAMQJQLTSBTKY/"
        },
        {
          "name": "FEDORA-2022-445ec90e7c",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4KCNZYBQC2FM5SEEDRQZO4LRZ4ZECMG/"
        },
        {
          "name": "FEDORA-2022-ad2b0ad61b",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYSHMF6MEIITFAG7EJ3IQKVUN7MDV2XM/"
        }
      ],
      "source": {
        "advisory": "c458b868-63df-414e-af10-47e3745caa1d",
        "discovery": "EXTERNAL"
      },
      "title": "Improper Authorization in cobbler/cobbler",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2022-0860",
          "STATE": "PUBLIC",
          "TITLE": "Improper Authorization in cobbler/cobbler"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "cobbler/cobbler",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "3.3.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "cobbler"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-285 Improper Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/c458b868-63df-414e-af10-47e3745caa1d",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/c458b868-63df-414e-af10-47e3745caa1d"
            },
            {
              "name": "https://github.com/cobbler/cobbler/commit/9044aa990a94752fa5bd5a24051adde099280bfa",
              "refsource": "MISC",
              "url": "https://github.com/cobbler/cobbler/commit/9044aa990a94752fa5bd5a24051adde099280bfa"
            },
            {
              "name": "FEDORA-2022-224e71968f",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DYWYHWVVRUSPCV5SWBOSAMQJQLTSBTKY/"
            },
            {
              "name": "FEDORA-2022-445ec90e7c",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D4KCNZYBQC2FM5SEEDRQZO4LRZ4ZECMG/"
            },
            {
              "name": "FEDORA-2022-ad2b0ad61b",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYSHMF6MEIITFAG7EJ3IQKVUN7MDV2XM/"
            }
          ]
        },
        "source": {
          "advisory": "c458b868-63df-414e-af10-47e3745caa1d",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2022-0860",
    "datePublished": "2022-03-11T12:50:10",
    "dateReserved": "2022-03-04T00:00:00",
    "dateUpdated": "2024-08-02T23:40:04.519Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

ghsa-mcg6-h362-cmq5

Vulnerability from github

Published

2022-03-11 20:52

Modified

2024-11-18 16:26

Severity ?

8.2 (High) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
6.7 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

Summary

Improper Authorization in cobbler

Details

Impact

If PAM is correctly configured and a user account is set to expired, the expired user-account is still able to successfully log into Cobbler in all places (Web UI, CLI & XMLRPC-API).

The same applies to user accounts with passwords set to be expired.

Patches

There is a patch for the latest Cobbler 3.3.2 available, however a backport will be done for 3.2.x.

Workarounds

Delete expired accounts which are able to access Cobbler via PAM.
Use chage -l <username> to lock the account. If the account has SSH-Keys attached then remove them completely.

References

Originally discovered by @ysf at https://www.huntr.dev/bounties/c458b868-63df-414e-af10-47e3745caa1d/

How to test if my Cobbler instance is affected?

The following pytest test assumes that your PAM setup is correct. In case the added user is not able to login, this test does not make sense to be executed.

```python def test_pam_login_with_expired_user(): # Arrange # create pam testuser test_username = "expired_user" test_password = "password" test_api = CobblerAPI() subprocess_1 = subprocess.run( ["perl", "-e", "'print crypt(\"%s\", \"%s\")'" % (test_username, test_password)], stdout=subprocess.PIPE ) subprocess.run(["useradd", "-p", subprocess_1.stdout, test_username]) # change user to be expired subprocess.run(["chage", "-E0", test_username])

# Act
result = pam.authenticate(test_api, test_username, test_password)

# Assert - login should fail
assert not result

```

For more information

If you have any questions or comments about this advisory: * Open an issue in the Cobbler repository * Ask in the Gitter/Matrix Chat * Email us at cobbler.project@gmail.com

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "cobbler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-0860"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-11T20:52:04Z",
    "nvd_published_at": "2022-03-11T13:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nIf PAM is correctly configured and a user account is set to expired, the expired user-account is still able to successfully log into Cobbler in all places (Web UI, CLI \u0026 XMLRPC-API).\n\nThe same applies to user accounts with passwords set to be expired.\n\n### Patches\n\nThere is a patch for the latest Cobbler `3.3.2` available, however a backport will be done for `3.2.x`.\n\n### Workarounds\n\n- Delete expired accounts which are able to access Cobbler via PAM.\n- Use `chage -l \u003cusername\u003e` to lock the account. If the account has SSH-Keys attached then remove them completely.\n\n### References\n\n- Originally discovered by @ysf at https://www.huntr.dev/bounties/c458b868-63df-414e-af10-47e3745caa1d/\n\n### How to test if my Cobbler instance is affected?\n\nThe following `pytest` test assumes that your PAM setup is correct. In case the added user is not able to login, this test does not make sense to be executed.\n\n```python\ndef test_pam_login_with_expired_user():\n    # Arrange\n    # create pam testuser\n    test_username = \"expired_user\"\n    test_password = \"password\"\n    test_api = CobblerAPI()\n    subprocess_1 = subprocess.run(\n        [\"perl\", \"-e\", \"\u0027print crypt(\\\"%s\\\", \\\"%s\\\")\u0027\" % (test_username, test_password)],\n        stdout=subprocess.PIPE\n    )\n    subprocess.run([\"useradd\", \"-p\", subprocess_1.stdout, test_username])\n    # change user to be expired\n    subprocess.run([\"chage\", \"-E0\", test_username])\n\n    # Act\n    result = pam.authenticate(test_api, test_username, test_password)\n\n    # Assert - login should fail\n    assert not result\n```\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [the Cobbler repository](https://github.com/cobbler/cobbler/issues/new/choose)\n* Ask in the [Gitter/Matrix Chat](https://gitter.im/cobbler/community)\n* Email us at [cobbler.project@gmail.com](mailto:cobbler.project@gmail.com)\n",
  "id": "GHSA-mcg6-h362-cmq5",
  "modified": "2024-11-18T16:26:19Z",
  "published": "2022-03-11T20:52:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/cobbler/cobbler/security/advisories/GHSA-mcg6-h362-cmq5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0860"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cobbler/cobbler/commit/9044aa990a94752fa5bd5a24051adde099280bfa"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-mcg6-h362-cmq5"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/cobbler/cobbler"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/cobbler/PYSEC-2022-177.yaml"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/c458b868-63df-414e-af10-47e3745caa1d"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D4KCNZYBQC2FM5SEEDRQZO4LRZ4ZECMG"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DYWYHWVVRUSPCV5SWBOSAMQJQLTSBTKY"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IYSHMF6MEIITFAG7EJ3IQKVUN7MDV2XM"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Improper Authorization in cobbler"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

pysec-2022-177

Vulnerability from pysec

CVE-2022-0860 (GCVE-0-2022-0860)

Vulnerability from cvelistv5

ghsa-mcg6-h362-cmq5

Vulnerability from github

Impact

Patches

Workarounds

References

How to test if my Cobbler instance is affected?

For more information

Tags

Sightings

Nomenclature