Bug 2298492 (CVE-2024-6840)

Summary:	CVE-2024-6840 automation-controller: Gain access to the k8s API server via job execution with Container Group
Product:	[Other] Security Response	Reporter:	Robb Gatica <rgatica>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	brking, haoli, hkataria, jcammara, jmitchel, jneedle, kshier, mabashia, pbraun, security-response-team, simaishi, smcdonal, stcannon, teagle, tfister, thavo, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An improper authorization flaw exists in the Ansible Automation Controller. This flaw allows an attacker using the k8S API server to send an HTTP request with a service account token mounted via `automountServiceAccountToken: true`, resulting in privilege escalation to a service account.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Deadline:	2024-09-05

Description Robb Gatica 2024-07-17 18:09:46 UTC

Using in-cluster access to k8s API server with the service account token mounted via `automountServiceAccountToken: true` configuration in AAP Automation Controller , it is possible to assume the identity of the service account and can potentially do anything that the service account is able to do.

Comment 1 errata-xmlrpc 2024-09-05 14:10:01 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.4 for RHEL 9
  Red Hat Ansible Automation Platform 2.4 for RHEL 8

Via RHSA-2024:6428 https://access.redhat.com/errata/RHSA-2024:6428