Bug 1856786 (CVE-2020-14328)

Summary:	CVE-2020-14328 Tower: SSRF: Server Side Request Forgery on webhooks
Product:	[Other] Security Response	Reporter:	Borja Tarraso <btarraso>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	cmeyers, gblomqui, gmainwar, mabashia, notting, rpetrell, smcdonal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	ansible_tower 3.7.2	Doc Type:	---
Doc Text:	A flaw was found in Ansible Tower. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing additional internal services and more particularly retrieving full details in case of error. The highest threat from this vulnerability is to data confidentiality.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-08-05 19:27:46 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1856790
Bug Blocks:	1856718

Description Borja Tarraso 2020-07-14 13:18:55 UTC

For a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or a modify a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to connect to internal services like http enabled databases or perform post requests towards internal services which are not intended to be exposed.

As an organization administrator, is it possible to manage webhooks (HTTP, mail, etc...). This feature could be returning the full details in case of error such as HTML source in case of HTTP/HTTPS, Server unavailable, Port status, etc. The main concern is too limit the informations given by this feature.

Comment 1 Borja Tarraso 2020-07-14 13:18:59 UTC

Statement:

Ansible Tower 3.7.1 as well as previous versions are affected.

Comment 4 Borja Tarraso 2020-07-20 08:14:31 UTC

Acknowledgments:

Name: Maxime ESCOURBIAC (Michelin CERT team)

Comment 5 errata-xmlrpc 2020-08-05 14:46:51 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Tower 3.7 for RHEL 7

Via RHSA-2020:3328 https://access.redhat.com/errata/RHSA-2020:3328

Comment 6 Product Security DevOps Team 2020-08-05 19:27:46 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-14328