Updates released on Monday for the Ansible IT automation platform address a security bypass vulnerability that can be exploited to execute arbitrary commands on the Ansible controller and gain access to the hosts connected to it.
Ansible is an open-source automation solution acquired by Red Hat in 2015. The platform can be used to automate various tasks, including configuration management, cloud provisioning, application deployment, task execution and multinode orchestration.
The central node in an Ansible installation, known as the controller, is designed to be highly secure. Its attack surface is small as it does not expose any services to hosts. However, there is a weak spot that researchers from Netherlands-based Computest have found a way to exploit.
The Ansible controller receives so-called “facts” about the remote systems it manages and uses them for various purposes. Certain facts are filtered in order to prevent abuse, but experts have identified six different methods that can be leveraged to bypass this filter.
An attacker who can bypass the filter and gain control of certain facts can execute arbitrary commands on the Ansible controller, and from there move to the other hosts.
“Some facts have special meaning, like the fact ‘ansible_python_interpreter’ and ‘ansible_connection’. The former defines the command to be run when Ansible is looking for the python interpreter, and the second determines the host Ansible is running against,” Computest said. “If an attacker is able to control the first fact he can execute an arbitrary command, and if he is able to control the second fact he is able to execute on an arbitrary (Ansible-controlled) host. This can be set to ‘local’ to execute on the Controller itself.”
Computest informed the Ansible and Red Hat security teams about this issue on December 8 and 9. Ansible versions 2.2.1 RC3 and 2.1.4 RC1, released on Monday, contain fixes for the vulnerability.
The security hole is tracked as CVE-2016-9587 and it has been rated “high risk.” Technical details about the methods used by Computest to bypass filters are available in the advisory published by the company.
Related Reading: Serious Vulnerabilities Found in McAfee Enterprise Product
Related Reading: Symantec Patches DLL Hijacking Flaw in Enterprise Products