Path traversal in Red Hat Ansible Engine

1) Path traversal

EUVDB-ID: #VU27558

Risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-10691

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote user to perform directory traversal attacks.

The vulnerability exists when extracting a collection .tar.gz file, the directory is created without sanitizing the filename when running ansible-galaxy collection install. A remote user can send a specially crafted HTTP request and overwrite any file within the system.

This vulnerability affects versions 2.9.x prior to 2.9.7.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Red Hat Ansible Engine: 2.9.0 - 2.9.6

CPE2.3

• cpe:2.3:a:red_hat:red_hat_ansible_engine:2.9.0:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_ansible_engine:2.9.1:*:*:*:*:*:*:*
• cpe:2.3:a:red_hat:red_hat_ansible_engine:2.9.2:*:*:*:*:*:*:*

External links

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691
https://github.com/ansible/ansible/pull/68596

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.