CVE-2013-2121
published 2013-07-31CVE-2013-2121: Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to…
PriorityP350medium6CVSS 2.0
AVNACMAuSCPIPAP
EXPLOIT
EPSS
24.78%
97.9th percentile
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | openstack | — | — |
| theforeman | foreman | <= 1.2.0 | — |
| theforeman | foreman | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor POST requests to /bookmarks endpoint where the 'bookmark[controller]' parameter contains 'eval(' — this is the injection vector used to achieve remote code execution. ↗
- →The vulnerable code path is in the create method of BookmarksController: it passes the user-supplied controller attribute directly into an eval() call — flag any bookmark creation where the controller field contains Ruby code constructs. ↗
- →The controller attribute is validated with regex /\A(\S+)\Z/ (no spaces allowed), but attackers circumvent this — look for non-space Ruby expressions in the bookmark[controller] POST parameter. ↗
- →Exploit flow involves: (1) POST login to /users/login, (2) GET to harvest CSRF token, (3) POST to /bookmarks with injected controller parameter — correlate this 3-step sequence from a single source IP. ↗
- →The exploit targets Foreman 1.2.0-RC1 and earlier; alert on Foreman versions prior to 1.2.0-RC2 receiving POST requests to /bookmarks. ↗
- ·Exploitation requires the attacker to be authenticated and have permissions to create bookmarks — this is not an unauthenticated attack vector. ↗
- ·The Metasploit module defaults to SSL on port 443; detection rules should cover both HTTP (80) and HTTPS (443) traffic to the /bookmarks endpoint. ↗
- ·The fix was committed as ef4b97d177c58c9532730d53dca0517bc869a0ce and cherry-picked to 1.2-stable and 1.1-stable branches; patched instances are not vulnerable. ↗
CVSS provenance
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
vendor_redhat6.0MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j6g9-xm4c-vp6v: Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1
ghsa_unreviewed·2022-05-14
CVE-2013-2121 [MEDIUM] CWE-94 GHSA-j6g9-xm4c-vp6v: Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.
Red Hat
Foreman: app/controllers/bookmarks_controller.rb remote code execution
vendor_redhat·2013-06-07·CVSS 6.0
CVE-2013-2121 [MEDIUM] CWE-95 Foreman: app/controllers/bookmarks_controller.rb remote code execution
Foreman: app/controllers/bookmarks_controller.rb remote code execution
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.
No detection rules found.
Exploit-DB
Foreman (RedHat OpenStack/Satellite) - bookmarks/create Code Injection (Metasploit)
exploitdb·2013-07-23
CVE-2013-2121 Foreman (RedHat OpenStack/Satellite) - bookmarks/create Code Injection (Metasploit)
Foreman (RedHat OpenStack/Satellite) - bookmarks/create Code Injection (Metasploit)
---
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit4 'Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection',
'Description' => %q{
This module exploits a code injection vulnerability in the 'create'
action of 'bookmarks' controller of Foreman and Red Hat OpenStack/Satellite
(Foreman 1.2.0-RC1 and earlier).
},
'Author' => 'Ramon de C Valle',
'License' => MSF_LICENSE,
'References' =>
[
['CVE', '2013-2121'],
['CWE', '95'],
['OSVDB', '94671'],
['BID', '60833'],
['URL', 'h
Metasploit
Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection
metasploit
Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection
Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection
This module exploits a code injection vulnerability in the 'create' action of 'bookmarks' controller of Foreman and Red Hat OpenStack/Satellite (Foreman 1.2.0-RC1 and earlier).
http://projects.theforeman.org/issues/2631http://rhn.redhat.com/errata/RHSA-2013-0995.htmlhttp://www.exploit-db.com/exploits/27045https://bugzilla.redhat.com/show_bug.cgi?id=966804https://groups.google.com/forum/#%21topic/foreman-users/6WpO_3ugiXUhttp://projects.theforeman.org/issues/2631http://rhn.redhat.com/errata/RHSA-2013-0995.htmlhttp://www.exploit-db.com/exploits/27045https://bugzilla.redhat.com/show_bug.cgi?id=966804https://groups.google.com/forum/#%21topic/foreman-users/6WpO_3ugiXU
2013-07-31
Published