Miggo Logo

CVE-2023-5764: Ansible template injection vulnerability

6.6

CVSS Score
3.1

Basic Information

EPSS Score
0.22275%
Published
12/13/2023
Updated
9/16/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
ansible-corepip>= 2.16.0, < 2.16.12.16.1
ansible-corepip>= 2.15.0, < 2.15.82.15.8
ansible-corepip< 2.14.122.14.12

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper handling of 'unsafe' markers during templating operations. The patched functions all show modifications where unsafe data processing was strengthened by adding _strip_unsafe calls or blocking unsafe method execution. These functions directly handle template rendering, serialization, and conditional evaluation - the key areas where unsafe designation could be lost per CVE-2023-5764's description. The commit diffs demonstrate explicit security fixes in these specific functions across JSON/YAML serialization paths and template evaluation logic.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* t*mpl*t* inj**tion *l*w w*s *oun* in *nsi*l* w**r* * us*r's *ontroll*r int*rn*l t*mpl*tin* op*r*tions m*y r*mov* t** uns*** **si*n*tion *rom t*mpl*t* **t*. T*is issu* *oul* *llow *n *tt**k*r to us* * sp**i*lly *r**t** *il* to intro*u** t*mpl*tin* i

Reasoning

T** vuln*r**ility st*ms *rom improp*r **n*lin* o* 'uns***' m*rk*rs *urin* t*mpl*tin* op*r*tions. T** p*t**** *un*tions *ll s*ow mo*i*i**tions w**r* uns*** **t* pro**ssin* w*s str*n*t**n** *y ***in* _strip_uns*** **lls or *lo*kin* uns*** m*t*o* *x**ut
CVE-2023-5764: Ansible Template Injection RCE | Miggo