Bug 1856786 (CVE-2020-14328) - CVE-2020-14328 Tower: SSRF: Server Side Request Forgery on webhooks
Summary: CVE-2020-14328 Tower: SSRF: Server Side Request Forgery on webhooks
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-14328
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1856790
Blocks: 1856718
TreeView+ depends on / blocked
 
Reported: 2020-07-14 13:18 UTC by Borja Tarraso
Modified: 2021-02-23 16:05 UTC (History)
7 users (show)

Fixed In Version: ansible_tower 3.7.2
Doc Type: ---
Doc Text:
A flaw was found in Ansible Tower. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing additional internal services and more particularly retrieving full details in case of error. The highest threat from this vulnerability is to data confidentiality.
Clone Of:
Environment:
Last Closed: 2020-08-05 19:27:46 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:3328 0 None None None 2020-08-05 14:46:53 UTC

Description Borja Tarraso 2020-07-14 13:18:55 UTC 
For a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or a modify a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to connect to internal services like http enabled databases or perform post requests towards internal services which are not intended to be exposed.

As an organization administrator, is it possible to manage webhooks (HTTP, mail, etc...). This feature could be returning the full details in case of error such as HTML source in case of HTTP/HTTPS, Server unavailable, Port status, etc. The main concern is too limit the informations given by this feature.
Comment 1 Borja Tarraso 2020-07-14 13:18:59 UTC 
Statement:

Ansible Tower 3.7.1 as well as previous versions are affected.
Comment 4 Borja Tarraso 2020-07-20 08:14:31 UTC 
Acknowledgments:

Name: Maxime ESCOURBIAC (Michelin CERT team)
Comment 5 errata-xmlrpc 2020-08-05 14:46:51 UTC 
This issue has been addressed in the following products:

  Red Hat Ansible Tower 3.7 for RHEL 7

Via RHSA-2020:3328 https://access.redhat.com/errata/RHSA-2020:3328
Comment 6 Product Security DevOps Team 2020-08-05 19:27:46 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-14328
Note You need to log in before you can comment on or make changes to this bug.