CVE-2018-1101

Vulnerability

In Ansible Tower versions prior to 3.2.4, a flaw exists in how system and organization administrator roles are managed. An organization administrator, who is granted limited administrative rights within a specific organization, is able to reset the password of a system administrator who is also a member of that organization. This bypasses the intended privilege separation [1], [4].

Exploitation

An attacker must have an organization administrator account on an affected Ansible Tower instance (version < 3.2.4). No additional authentication or network position is required beyond that role. The attacker can directly use the password reset function on a system administrator account that belongs to the same organization, without any further authorization checks [1], [4].

Impact

Successful exploitation allows the organization administrator to change the password of a system administrator account. The system administrator role has full administrative access over the entire Ansible Tower installation. This results in complete privilege escalation, granting the attacker total control over the Ansible Tower environment, including all organizations, inventories, credentials, and job templates [1], [4].

Mitigation

The vulnerability is fixed in Ansible Tower version 3.2.4, released on 2018-05-02. Users should upgrade to this version or later. Red Hat also released errata RHSA-2018:1328 and RHSA-2018:1972 for affected Red Hat Ansible Tower products [2], [3]. There is no known workaround besides applying the patch.