Description

A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registry_authorize filter. While the application identifies unauthorized requests and triggers an error response via the unauthorized method, it fails to halt the execution of the current code path (missing return statement). This failure in the control flow allows the application to proceed into subsequent business logic and database validation filters. Consequently, the application reveals its internal state through differential responses, allowing an unprivileged attacker to enumerate valid Users, Organizations, and Products across the entire instance.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-01T18:17:19.763Z",
  "pubdate": "2026-10-01T18:17:19.763Z",
  "executiveSummary": "The rubygem-katello package contains an authorization bypass vulnerability located within the RegistryProxiesController.\nThe flaw originates from an improper control flow in the registry_authorize filter, specifically missing a return statement after an unauthorized error trigger.\nThis vulnerability allows unauthenticated or unprivileged attackers to bypass security checks and proceed into protected business logic.\nThe impact includes unauthorized information disclosure, enabling an attacker to enumerate valid Users, Organizations, and Products within the Katello instance.\nThe vulnerability is primarily an execution fall-through issue that results in a failure to properly enforce access control policies, leading to state exposure.\nNo specific authentication or high-privilege credentials are required to leverage this flaw, as the logic error occurs prior to full request validation completion.\nThe risk is significant due to the sensitive nature of the information exposed through differential responses generated by the application.",
  "technicalDetails": "The root cause of the vulnerability is an incomplete implementation of the 'registry_authorize' filter within the 'RegistryProxiesController' component of 'rubygem-katello'.\nIn Ruby on Rails controller filters, a 'before_action' or similar callback must halt the request cycle explicitly if authorization fails. The vulnerability arises because the 'registry_authorize' method calls an internal 'unauthorized' error response method but fails to return 'false' or invoke 'render plain/json ... and return' to cease execution of the subsequent code path.\nDue to the absence of the 'return' statement, the Ruby interpreter continues executing the remaining code within the controller action, even after the authorization error has been triggered. This creates an execution fall-through where the application proceeds to evaluate downstream business logic, database validation filters, and data retrieval processes.\nAn attacker can exploit this by crafting requests directed at the 'RegistryProxiesController'. When the application processes the request, the 'registry_authorize' filter flags the request as unauthorized; however, because the execution flow is not terminated, the application proceeds to access and validate against the database.\nThe attacker utilizes the resulting differential responses to determine the validity of various entities. By observing variations in HTTP status codes, error messages, or response times caused by successful or failed database queries in the subsequent logic, the attacker performs enumeration of internal resources.\nThis behavior allows for the systematic discovery of 'Users', 'Organizations', and 'Products' present in the system, effectively bypassing the intended security posture of the Katello instance.\nThe impact is a serious information disclosure vulnerability where the internal state of the application is leaked to an unprivileged actor, facilitating reconnaissance for further attacks or data harvesting. The vulnerability is persistent as long as the code execution path continues past the triggered error response in the controller filter."
}