CVE-2024-7923: Redhat Satellite Auth Bypass Vulnerability

CVE-2024-7923 Overview

An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Red Hat Satellite deployments (versions 6.13, 6.14, and 6.15) which are using Pulpcore version 3.0+ and could potentially enable unauthorized users to gain administrative access.

Critical Impact

This authentication bypass vulnerability allows unauthenticated remote attackers to gain administrative access to Red Hat Satellite deployments, potentially compromising the entire content management infrastructure and all managed hosts.

Affected Products

• Red Hat Satellite 6.13
• Red Hat Satellite 6.14
• Red Hat Satellite 6.15

Discovery Timeline

• September 4, 2024 - CVE-2024-7923 published to NVD
• November 24, 2024 - Last updated in NVD database

Technical Details for CVE-2024-7923

Vulnerability Analysis

This authentication bypass vulnerability (CWE-287) exists in the interaction between Apache's mod_proxy module and the Pulpcore application when deployed with Gunicorn. The root of the issue lies in how HTTP headers containing underscores are processed through the proxy chain.

When Apache's mod_proxy forwards requests to the Gunicorn backend, it fails to properly sanitize or unset certain HTTP headers due to RFC compliance restrictions on underscore characters in header names. The puppet-pulpcore configuration does not adequately address this gap, creating an exploitable authentication bypass condition.

An attacker can craft HTTP requests with specially formed headers that bypass the authentication mechanism entirely. Since this vulnerability is network-accessible, requires no privileges, and has no user interaction requirements, it presents a severe risk to exposed Satellite deployments. Successful exploitation grants the attacker full administrative access to the Satellite server, enabling control over content repositories, managed hosts, and organizational configurations.

Root Cause

The vulnerability stems from a configuration issue in the puppet-pulpcore module combined with Apache mod_proxy behavior. Apache's mod_proxy has specific handling rules for HTTP headers containing underscores, which are considered non-compliant with certain RFC specifications. Due to these restrictions, the proxy does not properly remove or sanitize headers that should be stripped before reaching the backend Pulpcore application. This allows an attacker to inject authentication-related headers that the backend trusts, effectively bypassing the authentication layer.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending crafted HTTP requests to an exposed Red Hat Satellite server with malformed headers containing underscores. These headers pass through Apache's mod_proxy without being properly sanitized due to the underscore handling restriction. When the Pulpcore backend receives these requests, it interprets the malformed authentication headers as legitimate, granting the attacker administrative access.

The attack flow involves:

1. Identifying an exposed Red Hat Satellite deployment running affected versions
2. Crafting HTTP requests with specially formed headers using underscore characters
3. Sending requests through Apache mod_proxy to the Pulpcore backend
4. Bypassing authentication due to improper header sanitization
5. Gaining administrative access to the Satellite server

Detection Methods for CVE-2024-7923

Indicators of Compromise

• Unusual administrative actions in Satellite audit logs from unexpected source IPs
• HTTP access logs showing requests with malformed or suspicious header patterns containing underscores
• Unexpected changes to content repositories, host configurations, or organizational settings
• Authentication logs showing successful admin access without corresponding credential usage

Detection Strategies

• Review Apache access logs for HTTP requests containing unusual header patterns, particularly those with underscore characters in header names
• Monitor Pulpcore and Satellite audit logs for administrative actions that don't correlate with legitimate administrator sessions
• Implement Web Application Firewall (WAF) rules to detect and block requests with suspicious header manipulation attempts
• Configure network monitoring to alert on unexpected traffic patterns to Satellite administrative endpoints

Monitoring Recommendations

• Enable verbose logging on Apache mod_proxy to capture detailed header information for forensic analysis
• Implement centralized log collection for Satellite, Apache, and Pulpcore logs to enable correlation analysis
• Set up alerts for administrative API calls originating from non-standard management networks or IP ranges
• Monitor for bulk changes to host configurations or repository settings that could indicate compromise

How to Mitigate CVE-2024-7923

Immediate Actions Required

• Apply the relevant Red Hat security advisory patches immediately based on your Satellite version
• Restrict network access to Satellite servers using firewall rules to limit exposure to trusted networks only
• Review Satellite audit logs for any signs of unauthorized administrative access
• Verify the integrity of content repositories and host configurations for unexpected modifications

Patch Information

Red Hat has released security advisories addressing this vulnerability across all affected Satellite versions:

• Satellite 6.13: Apply Red Hat Security Advisory RHSA-2024:6335
• Satellite 6.14: Apply Red Hat Security Advisory RHSA-2024:6336
• Satellite 6.15: Apply Red Hat Security Advisory RHSA-2024:6337

Additional patch information is available in Red Hat Security Advisory RHSA-2024:8906. For complete vulnerability details, refer to the Red Hat CVE-2024-7923 Details page.

Workarounds

• Implement network segmentation to ensure Satellite servers are only accessible from trusted management networks
• Configure Apache to explicitly reject or sanitize requests containing headers with underscore characters before forwarding to the backend
• Deploy a Web Application Firewall (WAF) in front of Satellite to filter malicious header manipulation attempts
• Consider upgrading Gunicorn to version 22.0 or later if possible, as this may address the underlying header handling issue

# Restrict network access to Satellite server (example iptables rule)
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Verify current Satellite version
satellite-maintain health check