package and service modules allow arbitrary modules to be executed

[samdoran]

SUMMARY

CVE-2020-1738

Both package and service modules use facts to determine the name of the module to run if use is not passed to the module. The ansible_facts['pkg_mgr'] and ansible_facts['service_mgr'] facts could be set to another module name or a module name installed in a collection such as ansible_collections.namespace.name./tmp/reverse-shell, which would allow arbitrary code execution on the managed node.

A potential fix would be to whitelist valid modules for package and service and/or have the collection loader validate the collection path to not allow arbitrary files.

The collection loader part may already be fixed in 2.9.

ISSUE TYPE

• Bug Report

COMPONENT NAME

lib/ansible/plugins/action/service.py
lib/ansible/plugins/action/package.py

ANSIBLE VERSION

2.10

CONFIGURATION

default

OS / ENVIRONMENT

STEPS TO REPRODUCE

EXPECTED RESULTS

ACTUAL RESULTS

[ansibot]

Files identified in the description:

• lib/ansible/modules/packaging/os/package.py
• lib/ansible/modules/system/service.py

If these files are inaccurate, please update the component name section of the description or use the !component bot command.

click here for bot help

[bcoca]

Going to close this one as it requires the remote to already be compromised in a way that this does not expand upon. To trigger this you already need to be able to either intercept communications with the target (so you can already alter payloads) or intercept what is executed on the target (so you already can control what is executed).

As for having the user install malicious collection to use in conjunction with this to execute arbitrary code on the controller, instead you can have them install a malicious role and override builtin actions, which is a much simpler approach w/o requiring an additional exploited remote target.