CVE-2017-12148: Input Validation
A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project (SCM repository) definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that, when executed by Tower, modifies the checked out SCM repository to add git hooks. These git hooks could, in turn, cause arbitrary command and code execution as the user Tower runs as.
Other sources
If a Tower project (SCM repo) definition does not have the 'delete before update' flag set, a user who has commit access to the upstream playbook source repo could create a trojan playbook that, when executed by Tower, modifies the checked out SCM repository to add git hooks.
On the next SCM update, these git hooks would then run, therefore running arbitrary code as the 'awx' (Tower service) user.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-12148?
CVE-2017-12148 is considered a critical vulnerability due to the potential for unauthorized execution of malicious playbooks.
How do I fix CVE-2017-12148?
To fix CVE-2017-12148, ensure that the 'delete before update' flag is set in the SCM repository project definition.
Which versions of Ansible Tower are affected by CVE-2017-12148?
CVE-2017-12148 affects Ansible Tower versions prior to 3.1.5 and 3.2.0.
Can CVE-2017-12148 affect my cloud environment?
Yes, if you are using affected versions of Ansible Tower within your cloud environment, CVE-2017-12148 poses a risk.
Is there a mitigation for CVE-2017-12148?
The primary mitigation for CVE-2017-12148 is to upgrade to the latest versions of Ansible Tower that are not vulnerable.