Description
A flaw was found in the MiqExpression module of ManageIQ where a low privilege user could enter a crafted Ruby string which would be evaluated. Successful exploitation will allow an attacker to execute arbitrary code with root privileges on the host system.
Mitigation
If possible, restrict users, via RBAC, to only the part of the application that they need access to. While MiqExpression is widely used throughout the product, restricting users can limit the surface of the attack.
At this time there are no workarounds outside of directly patching with the fixed code, so it is recommended to upgrade immediately to a patched version.
Acknowledgements
ManageIQ would like to thank Jason Frey and Gregg Tanzillo for reporting this issue.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32756
Details
Fixed in jansa-4, kasparov-2, lasker-1
Description
A flaw was found in the MiqExpression module of ManageIQ where a low privilege user could enter a crafted Ruby string which would be evaluated. Successful exploitation will allow an attacker to execute arbitrary code with root privileges on the host system.
Mitigation
If possible, restrict users, via RBAC, to only the part of the application that they need access to. While MiqExpression is widely used throughout the product, restricting users can limit the surface of the attack.
At this time there are no workarounds outside of directly patching with the fixed code, so it is recommended to upgrade immediately to a patched version.
Acknowledgements
ManageIQ would like to thank Jason Frey and Gregg Tanzillo for reporting this issue.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32756
Details
Fixed in jansa-4, kasparov-2, lasker-1