CVE-2023-3971 Controller: html injection in custom login info
Attackers can inject HTML into custom login pages to capture user credentials, leading to account compromise in Ansible Automation Platform.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-3971?
CVE-2023-3971 is a high-severity cross-site scripting vulnerability in Red Hat Ansible Automation Platform 2.3 for RHEL 8, published on 4 Oct 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
An HTML injection flaw was found in Controller in the user interface settings. This flaw allows an attacker to capture credentials by creating a custom login page by injecting HTML, resulting in a complete compromise.
Which versions are affected by CVE-2023-3971?
It affects 4 products.
Linux distribution packages (20)
automation-controller Red Hat:ansible_automation_platform:2.3::el8 | All versions | 0:4.3.11-1.el8ap |
automation-controller-cli Red Hat:ansible_automation_platform:2.3::el8 | All versions | 0:4.3.11-1.el8ap |
automation-controller-server Red Hat:ansible_automation_platform:2.3::el8 | All versions | 0:4.3.11-1.el8ap |
automation-controller-ui Red Hat:ansible_automation_platform:2.3::el8 | All versions | 0:4.3.11-1.el8ap |
automation-controller-venv-tower Red Hat:ansible_automation_platform:2.3::el8 | All versions | 0:4.3.11-1.el8ap |
automation-controller Red Hat:ansible_automation_platform:2.3::el9 | All versions | 0:4.3.11-1.el9ap |
automation-controller-cli Red Hat:ansible_automation_platform:2.3::el9 | All versions | 0:4.3.11-1.el9ap |
automation-controller-server Red Hat:ansible_automation_platform:2.3::el9 | All versions | 0:4.3.11-1.el9ap |
automation-controller-ui Red Hat:ansible_automation_platform:2.3::el9 | All versions | 0:4.3.11-1.el9ap |
automation-controller-venv-tower Red Hat:ansible_automation_platform:2.3::el9 | All versions | 0:4.3.11-1.el9ap |
automation-controller Red Hat:ansible_automation_platform:2.4::el8 | All versions | 0:4.4.1-1.el8ap |
automation-controller-cli Red Hat:ansible_automation_platform:2.4::el8 | All versions | 0:4.4.1-1.el8ap |
automation-controller-server Red Hat:ansible_automation_platform:2.4::el8 | All versions | 0:4.4.1-1.el8ap |
automation-controller-ui Red Hat:ansible_automation_platform:2.4::el8 | All versions | 0:4.4.1-1.el8ap |
automation-controller-venv-tower Red Hat:ansible_automation_platform:2.4::el8 | All versions | 0:4.4.1-1.el8ap |
automation-controller Red Hat:ansible_automation_platform:2.4::el9 | All versions | 0:4.4.1-1.el9ap |
automation-controller-cli Red Hat:ansible_automation_platform:2.4::el9 | All versions | 0:4.4.1-1.el9ap |
automation-controller-server Red Hat:ansible_automation_platform:2.4::el9 | All versions | 0:4.4.1-1.el9ap |
automation-controller-ui Red Hat:ansible_automation_platform:2.4::el9 | All versions | 0:4.4.1-1.el9ap |
automation-controller-venv-tower Red Hat:ansible_automation_platform:2.4::el9 | All versions | 0:4.4.1-1.el9ap |
Products include Redhat Ansible Automation Controller, Redhat Ansible Automation Platform, Redhat Ansible Developer, Redhat Ansible Inside.
How do I fix CVE-2023-3971?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-3971 being exploited?
There is no known exploitation of CVE-2023-3971 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-p5xq-xr8f-3wj4, RHSA-2023:4340, RHSA-2023:4590.