CVE-2023-5764
📋 TL;DR
This CVE describes a template injection vulnerability in Ansible where unsafe template data can be executed, potentially allowing attackers to run arbitrary code. It affects Ansible users who process untrusted template data. The vulnerability stems from improper handling of template safety designations.
💻 Affected Systems
- Ansible
- Red Hat Ansible Automation Platform
📦 What is this software?
Ansible by Redhat
Ansible by Redhat
Ansible by Redhat
Ansible by Redhat
Ansible by Redhat
Ansible by Redhat
Extra Packages For Enterprise Linux by Fedoraproject
View all CVEs affecting Extra Packages For Enterprise Linux →
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, and lateral movement within the infrastructure.
Likely Case
Privilege escalation within Ansible-controlled systems, unauthorized configuration changes, and potential data manipulation.
If Mitigated
Limited impact with proper input validation and restricted template processing, potentially causing minor configuration issues.
🎯 Exploit Status
Exploitation requires attacker to supply malicious template data to vulnerable Ansible operations; no public exploits known at this time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Ansible Core 2.14.11, 2.15.6, 2.16.1
Vendor Advisory: https://access.redhat.com/errata/RHSA-2023:7773
Restart Required: No
Instructions:
1. Update Ansible Core using pip: 'pip install --upgrade ansible-core==2.14.11' (or appropriate version). 2. For Red Hat Ansible Automation Platform, apply updates via subscription manager. 3. Verify no breaking changes in your playbooks after update.
🔧 Temporary Workarounds
Restrict Template Processing
allAvoid processing untrusted template data in Ansible operations
# Review playbooks to ensure template data sources are trusted
# Implement input validation for any external template inputs
Use Jinja2 Sandboxing
allEnable Jinja2 sandbox environment for template processing
ansible-config set DEFAULT_JINJA2_SANDBOX true
# Configure in ansible.cfg: jinja2_sandbox = True
🧯 If You Can't Patch
- Implement strict input validation for all template data sources
- Isolate Ansible controller from untrusted networks and implement network segmentation
🔍 How to Verify
Check if Vulnerable:
Check Ansible version: 'ansible --version' and verify if within affected ranges (2.14.0-2.14.10, 2.15.0-2.15.5, 2.16.0).Check Version:
ansible --version | head -1Verify Fix Applied:
Confirm version is 2.14.11+, 2.15.6+, or 2.16.1+ using 'ansible --version'.📡 Detection & Monitoring
Log Indicators:
- Unusual template processing errors in Ansible logs
- Unexpected Jinja2 template execution patterns
- Ansible controller processing unexpected external files
Network Indicators:
- Ansible controller receiving template data from untrusted sources
- Unusual outbound connections from Ansible controller post-template processing
SIEM Query:
source="ansible.log" AND ("template injection" OR "unsafe template" OR "Jinja2 error")🔗 References
- https://access.redhat.com/errata/RHSA-2023:7773
- https://access.redhat.com/security/cve/CVE-2023-5764
- https://bugzilla.redhat.com/show_bug.cgi?id=2247629
- https://access.redhat.com/errata/RHSA-2023:7773
- https://access.redhat.com/security/cve/CVE-2023-5764
- https://bugzilla.redhat.com/show_bug.cgi?id=2247629
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7Q6CHPVCHMZS5M7V22GOKFSXZAQ24EU/
- https://security.netapp.com/advisory/ntap-20241025-0001/
