Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Security Infrastructure

Command Execution Vulnerability Patched in Ansible

Updates released on Monday for the Ansible IT automation platform address a security bypass vulnerability that can be exploited to execute arbitrary commands on the Ansible controller and gain access to the hosts connected to it.

Updates released on Monday for the Ansible IT automation platform address a security bypass vulnerability that can be exploited to execute arbitrary commands on the Ansible controller and gain access to the hosts connected to it.

Ansible is an open-source automation solution acquired by Red Hat in 2015. The platform can be used to automate various tasks, including configuration management, cloud provisioning, application deployment, task execution and multinode orchestration.

The central node in an Ansible installation, known as the controller, is designed to be highly secure. Its attack surface is small as it does not expose any services to hosts. However, there is a weak spot that researchers from Netherlands-based Computest have found a way to exploit.

The Ansible controller receives so-called “facts” about the remote systems it manages and uses them for various purposes. Certain facts are filtered in order to prevent abuse, but experts have identified six different methods that can be leveraged to bypass this filter.

An attacker who can bypass the filter and gain control of certain facts can execute arbitrary commands on the Ansible controller, and from there move to the other hosts.

“Some facts have special meaning, like the fact ‘ansible_python_interpreter’ and ‘ansible_connection’. The former defines the command to be run when Ansible is looking for the python interpreter, and the second determines the host Ansible is running against,” Computest said. “If an attacker is able to control the first fact he can execute an arbitrary command, and if he is able to control the second fact he is able to execute on an arbitrary (Ansible-controlled) host. This can be set to ‘local’ to execute on the Controller itself.”

Computest informed the Ansible and Red Hat security teams about this issue on December 8 and 9. Ansible versions 2.2.1 RC3 and 2.1.4 RC1, released on Monday, contain fixes for the vulnerability.

The security hole is tracked as CVE-2016-9587 and it has been rated “high risk.” Technical details about the methods used by Computest to bypass filters are available in the advisory published by the company.

Advertisement. Scroll to continue reading.

Related Reading: Serious Vulnerabilities Found in McAfee Enterprise Product

Related Reading: Symantec Patches DLL Hijacking Flaw in Enterprise Products

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

SecurityWeek’s Ransomware Resilience and Recovery Summit helps businesses to plan, prepare, and recover from a ransomware incident.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Malware & Threats

The NSA and FBI warn that a Chinese state-sponsored APT called BlackTech is hacking into network edge devices and using firmware implants to silently...