CVE-2017-12148

Vulnerability

A flaw exists in Ansible Tower's SCM repository handling before versions 3.1.5 and 3.2.0 [1]. When a Tower project (SCM repository) definition does not have the 'delete before update' flag enabled, an attacker with commit access to the upstream playbook source repository can inject a malicious playbook that modifies the checked-out SCM repository to add git hooks [2].

Exploitation

To exploit, an attacker must have commit access to the upstream playbook source repository. The attacker creates a Trojan playbook that, when executed by Tower, modifies the local SCM checkout to include git hooks. On the next SCM update, these hooks execute arbitrary commands with the privileges of the Tower service user (awx) [2].

Impact

Successful exploitation allows arbitrary command and code execution as the user Tower runs as (typically the awx user). This can lead to full compromise of the Tower service, including access to sensitive data, modification of configurations, and potential lateral movement within the infrastructure [1][2].

Mitigation

Red Hat released fixes in Ansible Tower versions 3.1.5 and 3.2.0 [1]. Users should upgrade to these versions or later. As a workaround, ensure the 'delete before update' flag is enabled for all SCM projects, which prevents the injection of git hooks [2].