[cobbler] Cobbler WebUI file inclusion in profile page

Dolev Farhi D.Farhi at F5.com
Wed May 7 11:28:49 UTC 2014


hello,

I would like to know whether this issue has been addressed before:

I have created a regular cobbler profile, nothing fancy.

The only thing I did different is changing the 'Kickstart' value to the famous /etc/passwd file.

After saving the profile, I went to 'View Kickstart' and managed to get all the passwd content.

This issue allows any remote attacker to get the local users list and I am quite sure this can be classified as a security vulnerability.

Please let me know as we have multiple cobbler instances here.

--

df








-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.fedorahosted.org/pipermail/cobbler/attachments/20140507/560c2f53/attachment.html>


More information about the cobbler mailing list