CVE-2017-12148 Code injection in Ansible Tower

High 8.4 Published 27 Jul 2018 Updated 5 Aug 2024

Attackers with commit access can inject malicious git hooks via SCM repositories, leading to arbitrary code execution on the Ansible Tower server.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2017-12148?

CVE-2017-12148 is a high-severity code injection vulnerability in Redhat Ansible Tower, published on 27 Jul 2018. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.

Official description

A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project (SCM repository) definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that, when executed by Tower, modifies the checked out SCM repository to add git hooks. These git hooks could, in turn, cause arbitrary command and code execution as the user Tower runs as.

Weakness: CWE-20

Which versions are affected by CVE-2017-12148?

It affects 2 products.

Products include Redhat Ansible Tower, Redhat Cloudforms.

How do I fix CVE-2017-12148?

Upgrade to a fixed version.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2017-12148 being exploited?

There is no known exploitation of CVE-2017-12148 in the wild and no public exploit code.

All Redhat Ansible Tower vulnerabilities

Sources

Also known as GHSA-fxg8-q29x-8w2q.