search

ansibleguy / webui

Basic WebUI for using Ansible
https://webui.ansibleguy.net
GNU General Public License v3.0
96 stars 7 forks source link

Problem: RCE by leveraging extra-vars #33

Closed simonvik closed 6 months ago

simonvik commented 8 months ago

Versions

-

Scope

Unknown

Issue

It might not be a problem depending on the security model but it can in theory allow someone to gain more access than they should have.

See: https://github.com/advisories/GHSA-4839-8mxx-4xr9

ansibleguy commented 8 months ago

Greetings!

Should at least be mentioned in the docs, yeah. As I see it - even allowing users to execute playbooks is by design a RCE in the context of the executing user. (when target is localhost)

superstes commented 8 months ago

Could be nice-to-have to allow a specific runner user. So the execution context is separated from the WebUI context. (Setting in System config)

P.E. User ansible-webui is running the WebUI and ansible-runner user is executing commands The WebUI user will need system privileges to become the runner user.

ansibleguy commented 8 months ago

Could be nice-to-have to allow a specific runner user. So the execution context is separated from the WebUI context. (Setting in System config)

Would be doable if ansible-runner would allow us to specify the subprocess-user (currently not possible). I've created a feature-request in the ansible-runner repo to find out if they would be OK with adding support for it.