CVE-2022-3697

A flaw was found in Ansible's amazon.aws collection, specifically in the ec2_instance module, related to the tower_callback parameter. The module was handling this parameter insecurely, causing the password supplied via tower_callback to be written in plaintext to log files. This oversight meant that sensitive credentials were exposed to anyone with access to the logs, violating the principle of securing secrets at rest and in transit [1].

Exploitation

An attacker who gains read access to the affected Ansible logs can retrieve the plaintext password. No special network position or authentication beyond log access is required; the exposure is purely a result of the insecure parameter handling. The attack surface is limited to environments where the tower_callback feature is used with the ec2_instance module [2].

Impact

Successful exploitation allows the attacker to obtain the password associated with the tower_callback functionality. With this credential, they could potentially gain unauthorized access to the associated tower (AWX/Ansible Tower) instance, leading to further compromise of managed hosts and automation workflows. The confidentiality of the system is directly impacted [1].

Mitigation

The issue was addressed in a fix merged on October 25, 2022, by setting tower_callback.set_password to no_log=True, which prevents the password from being logged [2]. Users should update the amazon.aws collection to the version containing this fix. As of the publication date, the vulnerability has been patched, and no workaround is necessary if the collection is updated [1].