Bug 2139426 (CVE-2022-3841)

The /api/proxy/plugin/acm/console/multicloud/ansibletower endpoint can be accessed without authentication. The only checks performed are the presence of an openshift-session-token cookie regardless of its value and setting a csrf-token cookie with a dummy value.

This endpoint allows users to supply a URL and a token of an Ansible Tower server. Upon receiving this information, the hub performs a HTTPs requests to the given URL while setting the token as the Bearer value in the Authorization header. No checks are performed on the URL and it is therefore fully controlled by the attacker.

This leads to a Server Side Request Forgery (SSRF) attack, where an attacker can supply to the server, a whole or part of, a URL that will in turn be queried by the server. This is problematic since the server is considered to be in a privileged network position and can often reach exposed services that aren't readily available to clients due to network filtering.  Leveraging such an attack vector, the attacker can have an impact on other services and potentially disclose information or have other nefarious effects on the system.

In the present case, the server fetches the URL provided by the user and returns the full response, including HTTP headers, back to the attacker.