A flaw was found in ansible tower. Default installations are vulnerable to “Job Isolation” Escapes that allows an attacker to elevate to the “awx” user from outside the isolated environment.
Acknowledgments: Name: Matei Mal Badanoiu (Deloitte Romania)
This issue has been addressed in the following products: Red Hat Ansible Tower 3.7 for RHEL 7 Via RHSA-2021:0779 https://access.redhat.com/errata/RHSA-2021:0779
This issue has been addressed in the following products: Red Hat Ansible Tower 3.6 for RHEL 7 Via RHSA-2021:0778 https://access.redhat.com/errata/RHSA-2021:0778
This issue has been addressed in the following products: Red Hat Ansible Tower 3.8 for RHEL 7 Via RHSA-2021:0780 https://access.redhat.com/errata/RHSA-2021:0780
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2021-20253
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Red Hat's Justification for difference in CVSS Score: *AV: In order to perform the attack successfully i.e. elevating the privilege by escaping the isolation requires the project environment readable and writable to the "low_privilege" user which can not be done from outside the isolation environment.It has to be enabled from inside the isolation environment. So, it feels more adequate to set AV:L *UI: Someone needs to execute certain commands from inside the environment.A user interaction feels required. UI:R
Red Hat's Justification for difference in CVSS Score: *AV: In order to perform the attack successfully i.e. elevating the privilege by escaping the isolation requires the project environment readable and writable to the "low_privilege" user which can not be done from outside the isolation environment.It has to be enabled from inside the isolation environment. So, it feels more adequate to set AV:L *AC: In order to successfully exploit this vulnerability, an attacker will have to perform a series of exploit both from inside and from outside the isolated environment. So, it feels more adequate to set AC:H *UI: Someone needs to execute certain commands from inside the environment.A user interaction feels required. UI:R