PT-2017-5873 · Ansible+1 · Ansible+2
Adam Mariš
·
Published
2014-07-26
·
Updated
2022-05-14
·
CVE-2014-3498
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
ansible versions prior to 1.6.6
Description:
The issue allows remote authenticated users to execute arbitrary commands. This is possible because the user module in ansible can pass unfiltered input from variables through the jinja 2 template engine, potentially leading to arbitrary command execution. Under certain circumstances, an unprivileged user on a system managed via ansible can execute code on the managing host under the UID of the running ansible process.
Recommendations:
For versions prior to 1.6.6, update to version 1.6.6 or later to resolve the issue. As a temporary workaround, consider disabling the user module or restricting its use to minimize the risk of exploitation. Additionally, ensure that all input from variables is properly filtered before passing it through the jinja 2 template engine.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Ansible-Core
Ansible