Exploitation Summary
EIP tracks 2 public exploits for CVE-2013-2113.
PoCs published by Metasploit, including Metasploit module auxiliary/admin/http/foreman_openstack_satellite_priv_esc.
AI-analyzed exploit summary This exploit leverages a mass assignment vulnerability in Foreman (CVE-2013-2113) to create an arbitrary administrator account. It authenticates with valid credentials, retrieves a CSRF token, and submits a crafted POST request to elevate privileges.
Description
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.
Exploits (2)
This exploit leverages a mass assignment vulnerability in Foreman (CVE-2013-2113) to create an arbitrary administrator account. It authenticates with valid credentials, retrieves a CSRF token, and submits a crafted POST request to elevate privileges.
This Metasploit module exploits a mass assignment vulnerability in Foreman and Red Hat OpenStack/Satellite to create an arbitrary administrator account. It requires valid credentials with 'create_users' permission.