CVE-2021-3532: Ansible - Disclosure of Secret Information in Async Files
Summary
CVE-2021-3532: A flaw was found in Ansible where the secret information present in async_files are getting disclosed when the user changes the jobdir to a world readable directory. Affects ansible versions 1.0 – 9.9.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It is widely used in the industry for its simplicity and flexibility. Ansible Tower is a web-based user interface and REST API endpoint for Ansible that provides a centralized platform for managing and monitoring Ansible automation. Ansible Automation Platform is a comprehensive solution that combines Ansible Tower with additional features and capabilities. These tools are commonly used in enterprise environments to streamline and automate IT operations.
Vulnerability Detail
A flaw has been discovered in Ansible that allows for the disclosure of secret information present in async_files. This vulnerability arises when the user changes the jobdir to a world-readable directory. In such cases, any secret information stored in an async status file can be read by a malicious user on the system. This can lead to unauthorized access to sensitive data, including credentials, API keys, and other confidential information. The vulnerability affects Ansible Tower 3.7 and Ansible Automation Platform 1.2.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually set the jobdir to a directory with restricted access permissions. This can be achieved by modifying the Ansible configuration file and specifying a directory that is only accessible by authorized users. Here is an example of how to set the jobdir in the configuration file:
[defaults] jobdir = /path/to/restricted/directory
By setting the jobdir to a restricted directory, the risk of secret information disclosure in async_files can be mitigated.
Conclusion
The vulnerability in Ansible that allows for the disclosure of secret information in async_files can have serious security implications. It is crucial for users to update their Ansible Tower and Ansible Automation Platform installations to the latest versions that include the necessary patches. Additionally, setting the jobdir to a restricted directory can provide an extra layer of protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
This vulnerability allows a malicious user to read secret information stored in async status files. This can lead to unauthorized access to sensitive data, potentially compromising the security of the system and the confidentiality of the information.
Ansible Tower 3.7 and Ansible Automation Platform 1.2 are affected by this vulnerability. It is recommended to update to the latest versions to mitigate the risk.
At the time of this report, there are no known public exploits for this vulnerability. However, it is important to apply the recommended patches and security updates to protect against potential exploitation.
No, this vulnerability requires local access to the system. An attacker would need to have access to the jobdir directory to exploit the vulnerability.
Yes, the vulnerability can be fixed by updating Ansible Tower to version 3.8 or later, or Ansible Automation Platform to version 1.3 or later. These updated versions include a patch that addresses the issue and prevents the disclosure of secret information in async_files.
References
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
