Foreman WebSocket Proxy Command Injection (CVE-2026-1961) — PoC

Proof-of-concept for a command injection vulnerability in Foreman's WebSocket proxy (lib/ws_proxy.rb), disclosed responsibly to Red Hat and patched.

Summary

Foreman's WebSocket proxy interpolates an unsanitized host value, sourced from a compute resource provider's API response (e.g. VMware vSphere HostSystem.name), directly into a shell command executed via Open3.popen3. An attacker who controls or spoofs a compute resource server that a Foreman instance connects to can inject arbitrary shell commands, achieving remote code execution as the foreman user when an administrator opens a VM's Console.

Successful exploitation grants access to Foreman's database credentials and encryption keys, exposing all stored infrastructure credentials (vCenter, AWS, SSH keys, API tokens) and enabling further pivoting into the managed infrastructure.

Details

CVE	CVE-2026-1961
CWE	CWE-78 (OS Command Injection)
CVSS 3.1	8.0 (High) - AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Affected component	lib/ws_proxy.rb
Affected versions	Foreman up to and including 3.18.0 (confirmed on 3.17.0; code path unchanged since 2020)
Fixed in	Foreman 3.18.1, 3.17.2, 3.16.3
Authentication required	None (attacker runs the malicious server; the Foreman admin authenticates to it as part of normal workflow)
User interaction	Administrator clicks Console on a VM (normal workflow)
Advisory	https://access.redhat.com/security/cve/cve-2026-1961

Root Cause

At lib/ws_proxy.rb:44, the host parameter is interpolated directly into a shell command string:

cmd = "websockify --daemon --idle-timeout=#{idle_timeout} --timeout=#{timeout} #{port} #{host}:#{host_port}"

host comes from the compute resource API response and is never sanitized before being passed to a shell via Open3.popen3.

Proof of Concept

malicious_vsphere_server.py implements a minimal vSphere SOAP API, enough to handle authentication and VM enumeration, and returns a poisoned HostSystem.name value containing a shell metacharacter payload.

Usage

python3 malicious_vsphere_server.py

Reproduction Steps

1. Start the malicious vSphere server on the attacker system:

   python3 malicious_vsphere_server.py
   

2. Configure a Foreman compute resource (Foreman UI):
   • Navigate to Infrastructure → Compute Resources → Create Compute Resource
   • Provider: VMware
   • vCenter/Server: <attacker_ip>
   • Username / Password: any (user / pass)
   • Load Datacenters (loads EvilDatacenter)
   • Display Type: VNC
   • Uncheck VNC Console Passwords and Enable Caching
   • Submit
3. Trigger exploitation:
   • Navigate to the Virtual Machines tab
   • Locate TestVM
   • Actions → Console
4. Verify RCE on the Foreman server:

   find /tmp -name "vsphere_rce.txt" 2>/dev/null
   cat /tmp/systemd-private-*/tmp/vsphere_rce.txt
   

   Expected output: foreman

Author

Houssam Sahli (Malleum)

Legal

Released post-patch, following coordinated disclosure. Provided for authorized security testing and educational purposes only. Do not use against systems you do not own or do not have explicit permission to test.