REDHAT-BUG-2512372: Low severity Red Hat Automation Controller vulnerability
A flaw was found in automation-controller. The notification template Jinja whitelist only inspects static Getattr AST nodes. An attacker with notification template admin privileges can bypass the whitelist using dynamic subscript expressions or conditional gating on runtime values that differ from the test-render stub. Exceptions raised during notification rendering write full Python tracebacks into the notification body, which is sent to the attacker-controlled webhook URL, leaking install paths, Python version, and source file line numbers.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs notification template administrator privileges in Automation Controller. The leaked traceback is delivered to a webhook URL controlled by that attacker.
What techniques allow the template restrictions to be bypassed?
The whitelist checks only static Getattr AST nodes. Dynamic subscript expressions, or conditional logic based on runtime values that differ from the test-render stub, can bypass that inspection.
What information could be exposed if exploitation triggers an exception?
Notification-rendering exceptions can place full Python tracebacks in the notification body. These tracebacks may disclose installation paths, the Python version, and source-file line numbers.