Controller registers LOG_AGGREGATOR_HOST as a bare CharField with no character
  validation, and the logging settings validator only verifies that host/type
  are present. When any LOG_AGGREGATOR* setting is changed via
  PATCH /api/controller/v2/settings/logging/ (superuser-only), Controller
  regenerates /var/lib/awx/rsyslog/rsyslog.conf and restarts awx-rsyslogd. In the
  tcp/udp (omfwd) code path the host value is written raw as target="{host}",
  allowing an attacker to close the action() statement and append
  module(load="omprog") plus an omprog action() whose binary= runs an arbitrary
  shell command in the rsyslog control-plane component (uid=awx). That process can
  read SECRET_KEY and the Postgres credentials, decrypt every stored Credential,
  and forge inter-service JWTs.
    Upstream:        https://github.com/ansible/awx (devel) — UNFIXED (no PR)
    Affected file:   awx/main/utils/external_logging.py
                     (construct_rsyslog_conf_template: :26 spoolDirectory,
                      :100 errorfile, :128 target); awx/main/conf.py
                     (:565-574, :958-979); awx/conf/views.py (:131-133)