Code Injection in Red Hat Ansible Engine - CVE-2020-10684

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU29017

Code Injection in Red Hat Ansible Engine - CVE-2020-10684

Published: June 15, 2020


Vulnerability identifier: #VU29017
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2020-10684
CWE-ID: CWE-94
Exploitation vector: Local access
Exploit availability: No public exploit available
Vendor: Red Hat Inc.
Affected software:
Red Hat Ansible Engine

Detailed vulnerability description

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when using "ansible_facts" as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the "ansible_facts" after the clean. A local user can alter the "ansible_facts", such as "ansible_hosts", "users" and any other key data which would lead into privilege escalation or code injection

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


How to mitigate CVE-2020-10684

Install updates from vendor's website.

Sources