REDHAT-BUG-2511901: High severity Ansible AWX vulnerability
For GitHub pullrequest webhooks, geteventstatusapi() in awx/api/views/webhooks.py returns pullrequest.statusesurl from the request body verbatim without any host validation:
def geteventstatusapi(self): if self.geteventtype() != 'pullrequest': return return self.request.data.get('pullrequest', {}).get('statusesurl')
The value is persisted into job extravars and later used by updatewebhookstatus() in awx/main/models/mixins.py:
statusapi = self.extravarsdict.get('awxwebhookstatusapi') headers = {k: v.format(self.webhookcredential.getinput('token')), 'Content-Type': 'application/json'} response = requests.post(statusapi, data=json.dumps(data), headers=headers, timeout=30)
There is no host allowlist for the expected Git provider endpoint and no private-network egress filtering before the request is sent. The webhook receiver relies on an HMAC secret (webhookkey), which is readable by users with the admin role on the job template via /api/v2/jobtemplates/{id}/webhookkey/. This allows a template admin to forge a signed webhook payload with statusesurl pointing to an attacker-controlled endpoint, and AWX will POST status updates including the Git PAT in the Authorization header to that endpoint.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the admin role on an affected job template can read that template's webhook HMAC secret and use it to forge a signed GitHub pull_request webhook payload. The attacker can set the pull request statuses_url to an endpoint they control.
What information can be exposed to an attacker-controlled endpoint?
AWX later sends a status update to the supplied URL and includes the Git personal access token from the webhook credential in the request headers. The missing host validation and private-network egress filtering also permit the request target to be outside the expected Git provider endpoint.
How can I determine whether a job template is exposed?
Review job templates that use GitHub pull_request webhooks and identify users with the template admin role, because those users can retrieve the webhook key through the job template webhook_key API endpoint. Also review whether the associated webhook credential contains a Git personal access token.