Executive brief
Ansible is an automation tool used to manage and configure systems across networks. A vulnerability in how Ansible processes facts (system information) sent from managed systems allows an attacker with control over a managed system to execute arbitrary code on the Ansible server with full server privileges. This could enable complete compromise of the automation infrastructure and all systems it manages.
Technical details
The vulnerability is an input validation flaw (CWE-20) in Ansible before version 2.3, specifically in the handling of facts data returned by client systems. An attacker with control over a managed/client system can craft malicious fact data and send it back to the Ansible server; due to insufficient validation, this allows arbitrary code execution on the server with Ansible's privileges. The attack requires network reachability to the Ansible server's fact collection mechanism and control over at least one managed system. The vulnerability affects all versions before 2.2.3.0, with patches available in Ansible 2.2.3.0 and later, as well as in version 2.3.
Affected products
- Ansible Ansible before 2.2.3.0
Timeline
- 2017: disclosed: CVE-2017-7466 assigned; vulnerability reported
- 2017: patched: Patches released in Ansible 2.2.3.0 and 2.3
- 2022-05-13: advisory: GitHub security advisory GHSA-3m8p-xpm6-8ww3 published