Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.
Acknowledgments: Name: Simon Vikström
The only way around this, as far as I can see, is to restrict ability to define extra variables for job templates (includes ability to define variables at the all levels, including from the inventory, a.s.o.). This, naturally, is crippling to the functionality of Tower. Anyone involved in playbook/role/inventory development/administration would have the ability to execute this exploit. Also, it would be possible for someone to craft a role, put it in Ansible Galaxy to attack any users using it.
This is now public: https://www.ansible.com/security
This issue has been addressed in Ansible Tower release 3.1.6 and 3.2.4, for more information please see https://www.ansible.com/security
This issue has been addressed in the following products: CloudForms Management Engine 5.9 Via RHSA-2018:1328 https://access.redhat.com/errata/RHSA-2018:1328
This issue has been addressed in the following products: CloudForms Management Engine 5.8 Via RHSA-2018:1972 https://access.redhat.com/errata/RHSA-2018:1972