Unauthorized Command Execution via Host Registration

CVE-2024-7700

Summary

A command injection vulnerability exists in the 'Host Init Config' template of the Foreman application. This flaw allows attackers with appropriate privileges to inject arbitrary commands via the 'Install Packages' field on the 'Register Host' page. While user interaction is required to execute the injected commands, it presents a substantial security risk if a user unknowingly runs the affected registration script. Mitigating this vulnerability is crucial for maintaining the integrity of host registration processes.

References