PT-2017-5873 · Ansible+1 · Ansible+2
Adam Mariš
·
Publicado
2014-07-26
·
Atualizado
2022-05-14
·
CVE-2014-3498
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
ansible versions prior to 1.6.6
Description:
The issue allows remote authenticated users to execute arbitrary commands. This is possible because the user module in ansible can pass unfiltered input from variables through the jinja 2 template engine, potentially leading to arbitrary command execution. Under certain circumstances, an unprivileged user on a system managed via ansible can execute code on the managing host under the UID of the running ansible process.
Recommendations:
For versions prior to 1.6.6, update to version 1.6.6 or later to resolve the issue. As a temporary workaround, consider disabling the user module or restricting its use to minimize the risk of exploitation. Additionally, ensure that all input from variables is properly filtered before passing it through the jinja 2 template engine.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Ansible-Core
Ansible