Vulnerabilidades

*** Pendiente de traducción *** An argument-injection flaw was found in the Ansible Automation Platform automation-controller<br /> system-job subsystem. The system-job template launch endpoint stores a user-supplied "days"<br /> variable without running the integer validation defined elsewhere for that field, and the<br /> dispatcher flattens the management-command argument list into a single string with spaces before<br /> the job runner re-splits it, so spaces in the value become additional command-line arguments.<br /> Because system jobs are executed in-process on the control node without the container isolation<br /> applied to all other job types, an authenticated user with superuser privileges can inject<br /> arbitrary arguments — including Python&amp;#39;s path option — into the control-plane awx-manage process,<br /> controlling its argument vector and the first entry of its module search path. Full remote code<br /> execution requires an additional import gadget that is not present in the current management<br /> commands, so the demonstrated impact is argument injection with control of the process search<br /> path rather than confirmed code execution.

*** Pendiente de traducción *** A flaw was found in the automation-controller input-validation<br /> guard sanitize_jinja(). The function uses two regular<br /> expressions to reject user-supplied Jinja, but the patterns<br /> stop at the first interior &amp;#39;}&amp;#39; or &amp;#39;%&amp;#39; character, so a Jinja<br /> expression containing an inner brace (for example an empty<br /> dict) is accepted while remaining valid Jinja. Because<br /> sanitize_jinja() is the sole guard on several launch-time<br /> fields — ad-hoc command module_args, Machine-credential<br /> username / become_method / become_user, and inventory host<br /> names — a low-privileged user can inject Jinja that ansible-core<br /> evaluates in the execution environment. This enables execution<br /> of arbitrary commands in the execution environment (bypassing an<br /> administrator&amp;#39;s AD_HOC_COMMANDS module allowlist) and disclosure<br /> of secrets belonging to credentials the attacker cannot read<br /> (by templating a co-attached credential&amp;#39;s injected environment<br /> variables), across the credential access-control boundary.

*** Pendiente de traducción *** A flaw was found in the Ansible Automation Platform automation-controller. In the shipped<br /> production configuration, the Controller trusts the client-supplied X-Forwarded-For header as<br /> the request&amp;#39;s client IP without verifying that it originated from a trusted proxy, and selects<br /> the leftmost (attacker-controlled) header value. As a result, an attacker can forge the source<br /> IP address recorded for their requests in the Controller&amp;#39;s audit and access logs, degrading<br /> the integrity of forensic and SIEM attribution. The flaw does not grant additional access.

*** Pendiente de traducción *** A flaw was found in the Ansible Automation Platform automation-controller. The<br /> WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats<br /> artifacts propagated between workflow nodes, is not wrapped in prevent_search() and is therefore<br /> accepted for arbitrary field lookups by the REST filter backend, even though it is omitted from<br /> the API serializer. Because the column is persisted before Ansible&amp;#39;s no_log masking is applied,<br /> a user with only read access to a workflow — or, via a regular-expression lookup that bypasses<br /> the JSON cross-relation filter guard through the world-readable credential-types endpoint, any<br /> authenticated user with no roles — can use the result count as a boolean/count oracle to recover,<br /> character by character, secret values that a playbook author explicitly marked no_log, including<br /> across organizations.

*** Pendiente de traducción *** A flaw was found in the automation-controller instance<br /> install-bundle endpoint. When a System Administrator downloads<br /> an execution/hop node&amp;#39;s install bundle, the controller signs an<br /> X.509 certificate with the receptor mesh certificate authority<br /> in which the Common Name, DNS subject-alternative-name, and<br /> receptor node-id are taken verbatim from the caller-chosen<br /> instance hostname, with a hard-coded ten-year validity, a random<br /> serial, and no issuance log or revocation list. Because the<br /> hostname charset validator is case-insensitive while the<br /> uniqueness validator is case-sensitive, an administrator can<br /> register a case variant of an existing control node&amp;#39;s hostname<br /> and obtain a mesh-CA-signed certificate that TLS peers, which<br /> match hostnames case-insensitively, accept as that control node.<br /> In managed/hosted deployments — where the customer holds<br /> controller superuser but the platform operator runs the mesh —<br /> this yields a long-lived, non-revocable mesh peer credential and,<br /> with an on-path position, TLS impersonation or interception of<br /> control/hybrid mesh nodes. It does not grant direct remote code<br /> execution, because receptor work submission is gated by a<br /> separate signing key not included in the bundle.

*** Pendiente de traducción *** A server-side request forgery flaw was found in the Ansible Automation Platform<br /> automation-controller email notification backend. The email backend passes the user-supplied SMTP<br /> host and port from a notification template directly to the SMTP client without validating that<br /> the target is not an internal, loopback, link-local, or reserved address. An authenticated user<br /> with organization notification-admin permission can create or modify an email notification<br /> template pointing at an arbitrary internal address, trigger a test, and have the controller task<br /> process open a raw TCP connection to that address. The resulting connection error is reflected<br /> back through the notification record, providing a three-state internal port-scan oracle (open,<br /> closed, filtered) over the control-plane&amp;#39;s cluster network, including the in-cluster Kubernetes<br /> API. When a shared organization template holds a stored SMTP password, redirecting the host can<br /> also cause that credential to be transmitted to an attacker-controlled server.

*** Pendiente de traducción *** A flaw was found in the Ansible Automation Platform automation-controller. When a<br /> WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory,<br /> unified_job_template, and credentials of each cloned node and fails to check the instance_groups<br /> (and execution_environment and labels) that were preserved from the original. A user with<br /> organization workflow-admin permission but no role on the referenced instance groups can copy a<br /> workflow, become its administrator, and launch jobs pinned to instance groups they are not<br /> authorized to use — including the control-plane instance group — bypassing the InstanceGroup<br /> use_role boundary and causing attacker-influenced automation to run in the control-plane<br /> execution context.

*** Pendiente de traducción *** A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated<br /> Bitbucket Data Center webhook receiver skips HMAC signature verification for diagnostics:ping<br /> events after it has already looked up the target template, causing the endpoint to return HTTP<br /> 200 for a template that has a Bitbucket DC webhook configured and HTTP 403 otherwise. An<br /> unauthenticated remote attacker can use this response discrepancy as an oracle to enumerate<br /> which Job Template and Workflow Job Template IDs have Bitbucket DC webhooks configured, without<br /> knowing the secret webhook_key.

*** Pendiente de traducción *** A flaw was found in Red Hat Ansible Automation Platform&amp;#39;s automation-<br /> controller. The setting that formats the log message emitted for API 4XX errors<br /> is an administrator-controlled Python format-string template that is rendered<br /> with a live user object as an argument. Because Python string formatting permits<br /> attribute and item traversal on its arguments, an administrator can craft a<br /> template that walks from the user object into the application settings and reads<br /> the Django secret key and the database password. The formatted message is written<br /> to a logger that can be forwarded to an external log aggregator, whose destination<br /> is also administrator-controlled, allowing the secrets to be sent off the host. An<br /> authenticated administrator can thereby obtain the master encryption key used to<br /> protect all stored credentials and the database service password, enabling offline<br /> decryption of every stored credential, forgery of user sessions, and direct<br /> access to the controller database.

*** Pendiente de traducción *** A flaw was found in the automation-controller API. The<br /> unauthenticated health-check endpoint /api/v2/ping/<br /> (ApiV2PingView, AllowAny) over-serializes RBAC-gated<br /> automation-mesh data into its anonymous response, exposing the<br /> full instance inventory (node hostnames, node types, UUIDs,<br /> heartbeats, capacities, and exact versions), all instance-group<br /> names and membership, the deployment install UUID, and the<br /> active control node. A remote, unauthenticated attacker can use<br /> this to map the control plane and fingerprint software versions<br /> for targeted attacks. This flaw affects confidentiality only;<br /> it does not expose secrets, credentials, or tenant data.

*** Pendiente de traducción *** A flaw was found in Red Hat Ansible Automation Platform&amp;#39;s automation-<br /> controller. The HTML view of job, ad hoc command, project update, and inventory<br /> update standard output escapes HTML metacharacters but does not remove ANSI<br /> terminal escape sequences before conversion to HTML. An ANSI OSC 8 hyperlink<br /> sequence in the output is expanded into an HTML anchor whose href is not scheme-<br /> filtered or escaped, so a low-privileged user who can produce output -- or an<br /> external party whose data a playbook echoes -- can embed a javascript: link that<br /> is rendered into a text/html response with no Content-Security-Policy. When a<br /> higher-privileged user views the output page and clicks the link, attacker-<br /> controlled JavaScript executes in their authenticated session, allowing actions<br /> as that user up to full platform takeover.

*** Pendiente de traducción *** A flaw was found in the automation-controller notification<br /> subsystem. Although NotificationTemplate.notification_<br /> configuration is protected from API filtering, its recipient<br /> value is copied in clear text into the unprotected<br /> Notification.recipients field on every send. Because the<br /> credential-types endpoint is listable by any authenticated<br /> user and the API filter backend traverses object relations<br /> without per-hop authorization, a user with no privileges can<br /> use a relational filter as a boolean count-oracle to recover,<br /> character by character and across organizations, the secret<br /> recipient values of other tenants&amp;#39; notifications — including<br /> PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook<br /> bearer-token URLs. This flaw affects confidentiality.