Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-3828

CVE-2019-3828: Ansible Path Traversal vulnerability

4.2

CVSS Score
3.1

Basic Information

CVE ID
CVE-2019-3828
GHSA ID
GHSA-74vq-h4q8-x6jv
EPSS Score
0.125%
CWE
CWE-22
Published
4/15/2019
Updated
11/18/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
ansiblepip< 2.5.152.5.15
ansiblepip>= 2.6.0a1, < 2.6.142.6.14
ansiblepip>= 2.7.0a1, < 2.7.82.7.8

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper path validation in the fetch module's handling of remote paths. The GitHub patch shows a critical addition of a '..' check in the _remote_expand_user method of ActionBase (in lib/ansible/plugins/action/init.py). This function is responsible for resolving remote user home directories, and prior to the patch, it allowed paths with '..' components, leading to directory traversal. The added validation in the commit 396a2f7 directly addresses this by raising an error when '..' is detected in the path. The accompanying unit test in test_action.py confirms this was the vulnerable point by testing the path traversal scenario.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*nsi*l* **t** mo*ul* ***or* v*rsions *.*.**, *.*.**, *.*.* **s * p*t* tr*v*rs*l vuln*r**ility w*i** *llows *opyin* *n* ov*rwritin* *il*s outsi** o* t** sp**i*i** **stin*tion in t** lo**l *nsi*l* *ontroll*r *ost, *y not r*stri*tin* *n **solut* p*t*.

Reasoning

T** vuln*r**ility st*ms *rom improp*r p*t* v*li**tion in t** **t** mo*ul*'s **n*lin* o* r*mot* p*t*s. T** *it*u* p*t** s*ows * *riti**l ***ition o* * '..' ****k in t** _r*mot*_*xp*n*_us*r m*t*o* o* **tion**s* (in li*/*nsi*l*/plu*ins/**tion/__init__.p