CVE-2020-14380
📋 TL;DR
This vulnerability allows attackers with valid external authentication (SSO or OpenID) to impersonate existing local users in Red Hat Satellite, gaining their privileges. It affects Red Hat Satellite 6.7.2 and later versions. Organizations using external authentication with Satellite are at risk.
💻 Affected Systems
- Red Hat Satellite
📦 What is this software?
Satellite by Redhat
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Satellite infrastructure, allowing attackers to manage all connected systems, deploy malicious content, and access sensitive data.
Likely Case
Privilege escalation to administrative accounts, enabling unauthorized configuration changes, system management, and data access.
If Mitigated
Limited impact if external authentication is properly restricted and monitored, with attackers only able to access low-privilege accounts.
🎯 Exploit Status
Requires valid external authentication credentials but no special technical skills to execute once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Satellite 6.7.3 and later
Vendor Advisory: https://access.redhat.com/security/cve/cve-2020-14380
Restart Required: Yes
Instructions:
1. Update Satellite to version 6.7.3 or later using 'satellite-maintain upgrade' command. 2. Restart Satellite services. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable External Authentication
linuxTemporarily disable SSO/OpenID authentication and use only local authentication
satellite-installer --foreman-authentication-methods=Internal
Restrict External Authentication Sources
allLimit which external authentication sources can access Satellite
Configure firewall rules to restrict access to authentication servers
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Satellite from untrusted networks
- Enable detailed authentication logging and monitor for suspicious account takeover attempts
🔍 How to Verify
Check if Vulnerable:
Check Satellite version with 'satellite-maintain health check --label version-check' and verify if external authentication is enabledCheck Version:
rpm -q satelliteVerify Fix Applied:
Verify Satellite version is 6.7.3+ and test external authentication functionality📡 Detection & Monitoring
Log Indicators:
- Multiple authentication attempts from same external user to different local accounts
- Unusual privilege escalation events in Satellite logs
Network Indicators:
- Unexpected authentication traffic patterns to Satellite from external sources
SIEM Query:
source="satellite" AND (event="authentication_failure" OR event="privilege_escalation")