Bug 2370812 (CVE-2025-49520)

Summary: CVE-2025-49520 event-driven-ansible: Authenticated Argument Injection in Git URL in EDA Project Creation
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: bilwei, haoli, hkataria, jajackso, jcammara, jmitchel, jneedle, kegrant, koliveir, kshier, mabashia, mkanoor, pbraun, security-response-team, shvarugh, simaishi, smcdonal, stcannon, teagle, tfister, thavo, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Ansible Automation Platform’s EDA component where user-supplied Git URLs are passed unsanitized to the git ls-remote command. This vulnerability allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes/OpenShift environments, this can lead to service account token theft and cluster access.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-06-06 15:11:36 UTC 
Authenticated Argument Injection vulnerability in the Git handling logic of the Ansible Automation Platform’s Event-Driven Ansible (EDA) component. The flaw occurs during EDA project creation, where the user-supplied Git repository URL is passed unvalidated to the git ls-remote command. By injecting malicious Git options, an attacker can execute arbitrary commands on the EDA worker. In Kubernetes or OpenShift environments, this enables attackers to exfiltrate the service account token of the pod, potentially granting access to secrets, pods, and other sensitive resources. The issue requires authenticated access but can be exploited remotely, without user interaction, leading to full system compromise.
Comment 2 errata-xmlrpc 2025-06-30 21:20:44 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 8
  Red Hat Ansible Automation Platform 2.5 for RHEL 9

Via RHSA-2025:9986 https://access.redhat.com/errata/RHSA-2025:9986