Symlink Attack Vulnerability in Ansible SSH ControlPersist
Summary
CVE-2013-4259: runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/. Affects ansible versions < 1.3.4+dfsg-1. Fixed in 1.3.4+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that simplifies the management of systems, applications, and networks. It allows users to automate tasks such as configuration management, application deployment, and orchestration. The tool operates through modules that can be executed on remote machines via SSH. However, prior to version 1.2.3, Ansible had a vulnerability in its SSH connection plugin that could be exploited by local users to redirect SSH sessions through a symlink attack on a socket file with a predictable name in the /tmp/ directory.
Vulnerability Detail
The vulnerability identified as CVE-2013-4259 exists in the runner/connection_plugins/ssh.py file of Ansible versions before 1.2.3. When using the ControlPersist feature, local users can create a symlink to the socket file, allowing them to redirect SSH sessions. This could lead to unauthorized access to sensitive information or control over the SSH session, posing significant security risks.
How To Fix
Minimum fixed version
1.3.4+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ansibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the ControlPersist feature in their SSH configuration to mitigate the risk of this vulnerability. This can be done by editing the SSH configuration file (usually located at /etc/ssh/ssh_config or ~/.ssh/config) and adding the following line: ControlPersist no.
Conclusion
CVE-2013-4259 is a significant vulnerability affecting Ansible versions before 1.2.3, allowing local users to exploit SSH sessions through a symlink attack. Users are strongly advised to upgrade to the latest version to mitigate risks. Additionally, temporary workarounds are available to enhance security until the upgrade can be performed.
See every vulnerability recorded for ansible →
FAQ
CVE-2013-4259 is a vulnerability in Ansible that allows local users to redirect SSH sessions through a symlink attack on a socket file.
You can check your Ansible version by running the command 'ansible --version' in your terminal. If it is below 1.3.4, it is affected.
The risks include unauthorized access to SSH sessions, potential data breaches, and control over remote systems.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
