PT-2023-5312 · Ansible · Ansible

Alevski · Publicado 2023-08-28 · Atualizado 2024-10-02 · CVE-2023-39059

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ansible semaphore version 2.8.90

Description The issue in ansible semaphore allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables parameter. This is related to incorrect code generation management in the configuration management system interface.

Recommendations For version 2.8.90, consider disabling the extra variables parameter until a patch is available to prevent exploitation. Restrict access to the vulnerable parameter to minimize the risk of arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2023-05938

CVE-2023-39059

GHSA-3R32-CP7V-5WQ4

Produtos afetados

Ansible

Referências · 12

• 🔥 https://alevsk.com/2023/07/a-quick-story-of-security-pitfalls-with-execcommand-in-software-integrations · Exploit
• https://github.com/ansible-semaphore/semaphore · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-39059 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-05938 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-39059 · Aviso do Fabricante
• https://gist.github.com/Alevsk/1757da24c5fb8db735d392fd4146ca3a · Nota
• https://t.me/cvenotify/57518 · Publicação no Telegram
• https://t.me/cvenotify/57479 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-3r32-cp7v-5wq4 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1696272505575719313 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1696325623252160984 · Publicação no Twitter
• https://t.me/cibsecurity/69327 · Publicação no Telegram