Bug 1565862 (CVE-2018-1104) - CVE-2018-1104 ansible-tower: Remote code execution by users with access to define variables in job templates
Summary: CVE-2018-1104 ansible-tower: Remote code execution by users with access to de...
Status: CLOSED ERRATA
Alias: CVE-2018-1104
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,public=20180427,repo...
Keywords: Security
Depends On: 1572740 1572747 1572748
Blocks: 1565867
TreeView+ depends on / blocked
 
Reported: 2018-04-11 00:16 UTC by Sam Fowler
Modified: 2019-06-11 11:13 UTC (History)
19 users (show)

(edit)
Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.
Clone Of:
(edit)
Last Closed: 2019-06-10 10:19:52 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:1328 None None None 2018-05-07 20:42 UTC
Red Hat Product Errata RHSA-2018:1972 None None None 2018-06-25 14:17 UTC

Description Sam Fowler 2018-04-11 00:16:19 UTC
Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.

Comment 1 Sam Fowler 2018-04-11 00:16:29 UTC
Acknowledgments:

Name: Simon Vikström

Comment 2 Magnus Glantz 2018-04-13 10:12:58 UTC
The only way around this, as far as I can see, is to restrict ability to define extra variables for job templates (includes ability to define variables at the all levels, including from the inventory, a.s.o.). This, naturally, is crippling to the functionality of Tower. Anyone involved in playbook/role/inventory development/administration would have the ability to execute this exploit.

Also, it would be possible for someone to craft a role, put it in Ansible Galaxy to attack any users using it.

Comment 4 Kurt Seifried 2018-05-02 16:05:21 UTC
This is now public: https://www.ansible.com/security

Comment 5 Kurt Seifried 2018-05-02 16:06:12 UTC
This issue has been addressed in Ansible Tower release 3.1.6 and 3.2.4, for more information please see https://www.ansible.com/security

Comment 6 errata-xmlrpc 2018-05-07 20:42:24 UTC
This issue has been addressed in the following products:

  CloudForms Management Engine 5.9

Via RHSA-2018:1328 https://access.redhat.com/errata/RHSA-2018:1328

Comment 7 errata-xmlrpc 2018-06-25 14:16:56 UTC
This issue has been addressed in the following products:

  CloudForms Management Engine 5.8

Via RHSA-2018:1972 https://access.redhat.com/errata/RHSA-2018:1972


Note You need to log in before you can comment on or make changes to this bug.