Security Infrastructure

Command Execution Vulnerability Patched in Ansible

Updates released on Monday for the Ansible IT automation platform address a security bypass vulnerability that can be exploited to execute arbitrary commands on the Ansible controller and gain access to the hosts connected to it.

Eduard Kovacs

January 11, 2017

Ansible is an open-source automation solution acquired by Red Hat in 2015. The platform can be used to automate various tasks, including configuration management, cloud provisioning, application deployment, task execution and multinode orchestration.

The central node in an Ansible installation, known as the controller, is designed to be highly secure. Its attack surface is small as it does not expose any services to hosts. However, there is a weak spot that researchers from Netherlands-based Computest have found a way to exploit.

The Ansible controller receives so-called “facts” about the remote systems it manages and uses them for various purposes. Certain facts are filtered in order to prevent abuse, but experts have identified six different methods that can be leveraged to bypass this filter.

An attacker who can bypass the filter and gain control of certain facts can execute arbitrary commands on the Ansible controller, and from there move to the other hosts.

“Some facts have special meaning, like the fact ‘ansible_python_interpreter’ and ‘ansible_connection’. The former defines the command to be run when Ansible is looking for the python interpreter, and the second determines the host Ansible is running against,” Computest said. “If an attacker is able to control the first fact he can execute an arbitrary command, and if he is able to control the second fact he is able to execute on an arbitrary (Ansible-controlled) host. This can be set to ‘local’ to execute on the Controller itself.”

Computest informed the Ansible and Red Hat security teams about this issue on December 8 and 9. Ansible versions 2.2.1 RC3 and 2.1.4 RC1, released on Monday, contain fixes for the vulnerability.

The security hole is tracked as CVE-2016-9587 and it has been rated “high risk.” Technical details about the methods used by Computest to bypass filters are available in the advisory published by the company.

Written By Eduard Kovacs

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Latest News

Click to comment

How the Atomized Network Changed Enterprise Protection

Our networks have become atomized which, for starters, means they’re highly dispersed. Not just in terms of the infrastructure – legacy, on-premises, hybrid, multi-cloud, and edge.

Matt Wilson

Mapping Threat Intelligence to the NIST Compliance Framework Part 2

How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.

Landon Winkelvoss

Password Dependency: How to Break the Cycle

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the password dependency cycle. But how can this be done?

Torsten George

Why CISOs Make Great Board Members

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make for successful board members.

Galina Antova

A Change in Mindset: From a Threat-based to Risk-based Approach to Security

A threat-based approach to security often focuses on a checklist to meet industry requirements but overlooked the key component of security: reducing risk.

Marie Hattar