Controller: html injection in custom login info

Vulnerability

An HTML injection vulnerability exists in the user interface settings of Red Hat Ansible Automation Platform Controller. The flaw allows an attacker to inject arbitrary HTML into the custom login page configuration. Affected versions include Red Hat Ansible Automation Platform 2.3 and 2.4 for RHEL 8 and RHEL 9 [1][2][3][4].

Exploitation

An attacker with administrative access to the Controller's UI settings can inject malicious HTML into the custom login page. When a user visits the login page, the injected HTML is rendered, potentially displaying a fake login form that captures credentials. No user interaction beyond visiting the page is required for the injected content to be served.

Impact

Successful exploitation allows an attacker to capture credentials of users logging into the Controller. This can lead to complete compromise of the Ansible Automation Platform instance, as the attacker gains administrative access to manage automation, credentials, and infrastructure.

Mitigation

The vulnerability is fixed in Red Hat Ansible Automation Platform 2.3 and 2.4 via RHSA-2023:4590 and RHSA-2023:4340 respectively [1][3][4]. Users should update to the latest patched versions. No workarounds are documented; updating is the recommended mitigation.