Template Injection Vulnerability in Ansible: Command Injection Risk
Summary
CVE-2021-3583: A flaw was found in Ansible, where a user's controller is vulnerable to template injection. Affects ansible across 2 version ranges.
< 2.10.7+merged+base+2.10.17+dfsg-0+deb11u1
< 8016c034da1140fe09f7db626124ebe04a27557a
Fixed in 2.10.7+merged+base+2.10.17+dfsg-0+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that enables users to configure systems, deploy software, and orchestrate more complex IT tasks. It uses a simple language called YAML to define automation tasks, making it accessible for users. However, a flaw has been identified in Ansible that exposes users to template injection vulnerabilities, particularly when handling multi-line YAML strings.
Vulnerability Detail
A flaw was found in Ansible where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity. The CVSS score for this vulnerability is 7.1, indicating a high severity level.
How To Fix
Minimum fixed version
2.10.7+merged+base+2.10.17+dfsg-0+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ansibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using multi-line YAML strings in their templates until the upgrade is applied. Additionally, ensure that any facts used in templates are sanitized to prevent the inclusion of special template characters.
Conclusion
The template injection vulnerability in Ansible poses a significant risk to users, allowing for command injection and potential data breaches. It is crucial for users to upgrade to the latest versions of Ansible and Ansible-core to mitigate this risk. Temporary workarounds can be employed, but the best course of action is to apply the necessary updates.
See every vulnerability recorded for ansible →
FAQ
The vulnerability allows attackers to perform command injection, potentially disclosing sensitive information and compromising the integrity of the system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
All versions of Ansible prior to 5.4.0-1 for Debian 12 and 13 are affected, along with earlier versions of Ansible-core.
Yes, as a temporary measure, avoid using multi-line YAML strings in your templates and sanitize any facts used in templates.
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
