CVE-2019-19342

Vulnerability

A flaw exists in Ansible Tower versions 3.6.x before 3.6.2 and 3.5.x before 3.5.4. When the /websocket endpoint is requested and the RabbitMQ password contains the # character, a socket error occurs during password parsing, causing an HTTP 500 error that discloses part of the password in plaintext [1].

Exploitation

An attacker needs network access to the Ansible Tower web interface and must be able to trigger a request to the /websocket endpoint. The target environment must have a RabbitMQ password containing the # character. The request causes a socket error in RabbitMQ, and the server returns an HTTP 500 error page that includes a portion of the password [1].

Impact

Successful exploitation results in partial disclosure of the RabbitMQ password in plaintext. This information can be used by an attacker to guess predictable passwords or aid in brute-force attacks against the full password [1].

Mitigation

Fixed versions are 3.6.2 and 3.5.4. Users should upgrade to these versions or later. As a workaround, administrators can change RabbitMQ passwords to avoid the # character, using longer, unpredictable strings to maintain strength [1].