CVE-2016-7040 Command injection in n/a

High 8.8 Published 7 Oct 2016 Updated 6 Aug 2024

Authenticated users can execute arbitrary shell commands in Red Hat CloudForms via malicious regular expressions in the API or UI.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-7040?

CVE-2016-7040 is a high-severity command injection vulnerability in n/a, published on 7 Oct 2016. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, which allows remote authenticated users to execute arbitrary shell commands by leveraging the ability to view and filter collections.

Weakness: CWE-284

Which versions are affected by CVE-2016-7040?

It affects 1 product.

Linux distribution packages (11)

`cfme` Red Hat:cloudforms_managementengine:5.6::el7	All versions	`0:5.6.2.1-1.el7cf`
`cfme-appliance` Red Hat:cloudforms_managementengine:5.6::el7	All versions	`0:5.6.2.1-1.el7cf`
`cfme-appliance-debuginfo` Red Hat:cloudforms_managementengine:5.6::el7	All versions	`0:5.6.2.1-1.el7cf`
`cfme-debuginfo` Red Hat:cloudforms_managementengine:5.6::el7	All versions	`0:5.6.2.1-1.el7cf`
`cfme-gemset` Red Hat:cloudforms_managementengine:5.6::el7	All versions	`0:5.6.2.1-1.el7cf`
`rh-ruby22-rubygem-nokogiri` Red Hat:cloudforms_managementengine:5.6::el7	All versions	`0:1.6.8-1.el7cf`
`rh-ruby22-rubygem-nokogiri-debuginfo` Red Hat:cloudforms_managementengine:5.6::el7	All versions	`0:1.6.8-1.el7cf`
`rh-ruby22-rubygem-pkg-config` Red Hat:cloudforms_managementengine:5.6::el7	All versions	`0:1.1.7-1.el7cf`
`rh-ruby22-rubygem-pkg-config-doc` Red Hat:cloudforms_managementengine:5.6::el7	All versions	`0:1.1.7-1.el7cf`
`rh-ruby22-rubygem-thin` Red Hat:cloudforms_managementengine:5.6::el7	All versions	`0:1.7.0-1.el7cf`
`rh-ruby22-rubygem-thin-debuginfo` Red Hat:cloudforms_managementengine:5.6::el7	All versions	`0:1.7.0-1.el7cf`

Products include Redhat Cloudforms Management Engine.

How do I fix CVE-2016-7040?

Apply the vendor's patch.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2016-7040 being exploited?

There is no known exploitation of CVE-2016-7040 in the wild and no public exploit code.

Sources

Also known as GHSA-7fr4-2q4f-xgw5, RHSA-2016:1996.