Privilege Escalation via Leapp Report Manipulation in ansible-collection-redhat-leapp

Executive Summary

This vulnerability is in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When a specific remediation task runs, the manipulated report causes the Ansible controller to read its own local files and copy them to the managed node, leading to information disclosure.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusual file reads or writes on Ansible controllers, especially after remediation tasks. Check Leapp report files on managed nodes for unexpected modifications or suspicious content. Review Ansible logs for tasks accessing local files on the controller.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to information disclosure, potentially exposing sensitive data on the Ansible controller such as private keys or credentials. Attackers could gain access to confidential information stored on the controller.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Exposure of private keys or credentials could result in data breaches, triggering legal and regulatory penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Restrict write access to Leapp report content on managed nodes to prevent manipulation. Ensure operators review reports before running remediation tasks to avoid unintended file reads or data exposure.

Useful 0 Not Useful 0