Security restrictions bypass in Red Hat Ansible Automation Platform 2.1
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2022-2568 |
| CWE-ID | CWE-264 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software |
Ansible Automation Platform Server applications / Other server solutions pulpcore-selinux (Red Hat package) Operating systems & Components / Operating system package or component automation-controller (Red Hat package) Operating systems & Components / Operating system package or component openshift-clients (Red Hat package) Operating systems & Components / Operating system package or component ansible-core (Red Hat package) Operating systems & Components / Operating system package or component python-galaxy-ng (Red Hat package) Operating systems & Components / Operating system package or component automation-hub (Red Hat package) Operating systems & Components / Operating system package or component |
| Vendor | Red Hat Inc. |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Security restrictions bypass
EUVDB-ID: #VU66553
Risk: Low
CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2022-2568
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote user to escalate privileges on the system.
The vulnerability exists due to a logic error within the API interface at the "/api/automation-hub/_ui/v1/users/1/ " URL. A remote authenticated user with 'change user' permissions can modify the account settings of the superuser account and even remove the superuser privileges.
Example:
HTTP request: PATCH http://localhost:5001/api/automation-hub/_ui/v1/users/1/ {"username": "admin", "is_superuser": false}Mitigation
Install updates from vendor's website.
Ansible Automation Platform: 2.1 - 2.1.2
pulpcore-selinux (Red Hat package): 1.3.1-1.el8ap
automation-controller (Red Hat package): 4.1.2-2.el8ap
openshift-clients (Red Hat package): 4.10.0-202202160023.p0.gf93da17.assembly.stream.el8 - 4.10.0-202203170916.p0.g6de42bd.assembly.stream.el8
ansible-core (Red Hat package): 2.11.6-1.el8ap
python-galaxy-ng (Red Hat package): 4.2.2-1.el8pc
automation-hub (Red Hat package): 4.2.2-1.el8pc
CPE2.3- cpe:2.3:a:red_hat:ansible_automation_platform:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:ansible_automation_platform:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:ansible_automation_platform:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:red_hat:pulpcore-selinux_redhat_package:1.3.1-1.el8ap:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:automation-controller_redhat_package:4.1.2-2.el8ap:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:openshift-clients_redhat_package:4.10.0-202202160023.p0.gf93da17.assembly.stream.el8:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:openshift-clients_redhat_package:4.10.0-202203141248.p0.g6db43e2.assembly.stream.el8:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:openshift-clients_redhat_package:4.10.0-202203170916.p0.g6de42bd.assembly.stream.el8:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:ansible-core_redhat_package:2.11.6-1.el8ap:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:python-galaxy-ng_redhat_package:4.2.2-1.el8pc:*:*:*:*:red_hat_enterprise_linux:*:*
- cpe:2.3:a:red_hat:automation-hub_redhat_package:4.2.2-1.el8pc:*:*:*:*:red_hat_enterprise_linux:*:*
https://access.redhat.com/errata/RHSA-2022:6078
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
