Platform: ec2_key module prints out the private key directly to the standard output

Vulnerability

Description

CVE-2023-4237 is a flaw in the Ansible Automation Platform, specifically within the ec2_key module [2]. When creating a new keypair, the module prints the private key directly to standard output, which is a deviation from secure handling practices. This behavior causes the private key to be captured in system logs, making it accessible to anyone with read access to those logs [1].

Exploitation

Scenario

An attacker who gains access to log files—for example, through a separate vulnerability or misconfigured logging systems—can retrieve the exposed private keys [3]. The attack does not require authentication to the Ansible Automation Platform itself; rather, it relies on access to the stored logs where the output was recorded. The ec2_key module is a widely used component for managing AWS EC2 key pairs, so deployments using this module are potentially affected [4].

Impact

Successful exploitation allows an attacker to obtain the private key for an AWS EC2 keypair. This key can then be used to gain unauthorized access to associated EC2 instances, compromising the confidentiality, integrity, and availability of the affected systems [1][2]. Since the private key is exposed, an attacker could potentially decrypt SSH traffic or authenticate to instances directly, leading to further lateral movement within the cloud environment.

Mitigation

Red Hat has released a bug fix advisory (RHBA-2023:5666) to address this issue [1]. Users are advised to update their Ansible Automation Platform installation to the fixed version. As a workaround until patching is possible, administrators should ensure that log files containing the output from the ec2_key module are securely stored and access is restricted to authorized personnel only. This CVE is not currently listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.