CVE-2024-10033 Aap-gateway: xss on aap-gateway
Attackers can inject malicious scripts via the 'next' URL parameter in the Ansible Automation Platform gateway, leading to session theft and data exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-10033?
CVE-2024-10033 is a medium-severity cross-site scripting vulnerability in Red Hat Ansible Automation Platform 2.5 for RHEL 8, published on 16 Oct 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability was found in aap-gateway. A Cross-site Scripting (XSS) vulnerability exists in the gateway component. This flaw allows a malicious user to perform actions that impact users by using the "?next=" in a URL, which can lead to redirecting, injecting malicious script, stealing sessions and data.
Weakness: CWE-79
Which versions are affected by CVE-2024-10033?
It affects 3 products.
Products include Redhat Ansible Automation Platform, Redhat Ansible Developer, Redhat Ansible Inside.
How do I fix CVE-2024-10033?
Apply the vendor's patch.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-10033 being exploited?
There is no known exploitation of CVE-2024-10033 in the wild and no public exploit code.
Other vulnerabilities in Red Hat Ansible Automation Platform 2.5 for RHEL 8
- CVE-2021-4112 Privilege escalation in ansible-tower
- CVE-2023-4237 Platform: ec2_key module prints out the private key directly to the standard output
- CVE-2021-3583 Improper Input Validation and Command Injection in Ansible
- CVE-2025-9907 Event-driven-ansible: event stream test mode exposes sensitive headers in aap eda
- CVE-2025-9908 Event-driven-ansible: sensitive internal headers disclosure in aap eda event streams
Sources
Also known as GHSA-h596-hg59-cxrq.