CVE-2020-14327: SSRF
A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. Functionality on the Tower server is abused by supplying a URL that could lead to the server processing it. This flaw leads to the connection to internal services or the exposure of additional internal services by abusing the test feature of lookup credentials to forge HTTP/HTTPS requests from the server and retrieving the results of the response.
Other sources
For a Server-Side Request Forgery (SSRF) attack, the attacker can abuse functionality on the server to read or update internal resources. The attacker can supply or a modify a URL which the code running on the server will read or submit data to, and by carefully selecting the URLs, the attacker may be able to connect to internal services like http enabled databases or perform post requests towards internal services which are not intended to be exposed.
In this case, any logged user can abuse of the test feature to forge HTTP/HTTPS requests from the awx server and get directly the result on the response. By default, the connector made a POST request to /authn/<account>/<username> authenticate to check the credential configuration. By using a malicious Apache server (with modrewrite), it is possible to generate any GET/POST (307 redirection) requests on the internal network. In addition, the POST request body can be managed by the user by using the apikey parameter and the proxy defined in the application setting was not taken in account.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this flaw?
The vulnerability ID of this flaw is CVE-2020-14327.
What is the severity level of CVE-2020-14327?
The severity level of CVE-2020-14327 is medium.
What is the affected software?
The affected software is Redhat Ansible Tower before version 3.6.5 and before version 3.7.2.
What is the description of this vulnerability?
CVE-2020-14327 is a Server-side request forgery (SSRF) flaw in Ansible Tower that allows an attacker to abuse functionality on the Tower server to connect to internal services or expose additional information.
How can I fix CVE-2020-14327?
To fix CVE-2020-14327, update Ansible Tower to version 3.6.5 or version 3.7.2.