CVE-2021-40348: spacewalk_project spacewalk Code Injection

Vulnerability summary

CVE-2021-40348 is a high (CVSS 9.3) Code Injection vulnerability in spacewalk_project spacewalk. EPSS estimates a 1.80% chance of exploitation in the next 30 days, higher than 78.1% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 01-11-2021
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Spacewalk 2.10, and derivatives such as Uyuni 2021.08, allows code injection. rhn-config-satellite.pl doesn't sanitize the configuration filename used to append Spacewalk-specific key-value pair. The script is intended to be run by the tomcat user account with Sudo, according to the installation setup. This can lead to the ability of an attacker to use --option to append arbitrary code to a root-owned file that eventually will be executed by the system. This is fixed in Uyuni spacewalk-admin 4.3.2-1.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.