CVE-2017-2653 Cross-site request forgery in CloudForms

Medium 4.1 Published 27 Jul 2018 Updated 5 Aug 2024

Attackers can bypass CSRF protection on unused delete routes via GET requests, potentially enabling destructive actions if combined with XSS.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2017-2653?

CVE-2017-2653 is a medium-severity vulnerability in Red Hat CloudForms, published on 27 Jul 2018. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protect_from_forgery XSRF protection causing the routes to be used. This attack would require additional cross-site scripting or similar attacks in order to execute.

Weakness: CWE-20

Which versions are affected by CVE-2017-2653?

It affects 2 products.

Linux distribution packages (5)

`cfme` Red Hat:cloudforms_managementengine:5.7::el7	All versions	`0:5.7.2.1-1.el7cf`
`cfme-appliance` Red Hat:cloudforms_managementengine:5.7::el7	All versions	`0:5.7.2.1-1.el7cf`
`cfme-appliance-debuginfo` Red Hat:cloudforms_managementengine:5.7::el7	All versions	`0:5.7.2.1-1.el7cf`
`cfme-debuginfo` Red Hat:cloudforms_managementengine:5.7::el7	All versions	`0:5.7.2.1-1.el7cf`
`cfme-gemset` Red Hat:cloudforms_managementengine:5.7::el7	All versions	`0:5.7.2.1-1.el7cf`

Products include Redhat Cloudforms, Redhat Cloudforms Management Engine.

How do I fix CVE-2017-2653?

Upgrade to a fixed version.

Is CVE-2017-2653 being exploited?

There is no known exploitation of CVE-2017-2653 in the wild and no public exploit code.

Sources

Also known as GHSA-xfgx-c33h-jf9f, RHSA-2017:0898.