Description
Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansible_ssh_common_args with a ProxyCommand or ansible_connection=local to execute commands as the Semaphore server user, exposing encryption keys, SSH keys and stored secrets.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
semaphoreui Semaphore UI
Default version status: unaffected
0 to ≤ 2.19.16affected
References
- https://github.com/semaphoreui/semaphore/pull/3888 ↗
- https://github.com/semaphoreui/semaphore/blob/v2.19.16/services/tasks/TaskRunner.go#L395-L431 ↗
- https://github.com/semaphoreui/semaphore/blob/v2.19.16/api/projects/tasks.go#L39-L75 ↗
- https://github.com/semaphoreui/semaphore ↗
- https://www.vulncheck.com/advisories/semaphore-ui-through-2.19.16-rce-via-task-environment-ansible-variable-override ↗