Security restrictions bypass in Ansible - CVE-2022-2568

Vulnerability identifier: #VU66553

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-2568

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to a logic error within the API interface at the "/api/automation-hub/_ui/v1/users/1/ " URL. A remote authenticated user with 'change user' permissions can modify the account settings of the superuser account and even remove the superuser privileges.

Example:

HTTP request:
PATCH http://localhost:5001/api/automation-hub/_ui/v1/users/1/ 
{"username": "admin", "is_superuser": false}

Ansible
pulpcore-selinux (Red Hat package)
ansible-core (Red Hat package)
automation-controller (Red Hat package)
automation-hub (Red Hat package)
python-galaxy-ng (Red Hat package)
openshift-clients (Red Hat package)
python3x-galaxy-ng (Red Hat package)
Ansible Automation Platform

Install updates from vendor's website.

Ansible - update to 2.12.8
pulpcore-selinux (Red Hat package) - update to 1.3.2-1.el8ap
Ansible Automation Platform - update to 2.1.3
ansible-core (Red Hat package) - update to 2.12.7-2.el8ap
automation-controller (Red Hat package) - update to 4.1.3-2.el8ap
automation-hub (Red Hat package) - update to 4.4.4-1.el8pc
python-galaxy-ng (Red Hat package) - addressed in versions 4.4.4-1.el8pc, 4.5.0-4.el9ap
openshift-clients (Red Hat package) - update to 4.10.0-202206211856.p0.g45460a5.assembly.stream.el8
python3x-galaxy-ng (Red Hat package) - update to 4.5.0-4.el8ap

• https://bugzilla.redhat.com/show_bug.cgi?id=2108653

• Security restrictions bypass in Red Hat Ansible
• Security restrictions bypass in Red Hat Ansible Automation Platform 2.1
• Security restrictions bypass in Red Hat Ansible Automation Platform 2.2 for RHEL 9 and 8