A flaw was found in Red Hat Ansible Automation Platform’s automation-
\ncontroller. The Project scm_url field is not validated against values that
\nbegin with a dash and is stored and passed verbatim to the git SCM module.
\nBecause the module runs git ls-remote with the URL as a positional argument and
\nwithout a “–” separator, a git project URL such as “–upload-pack=:x”
\nis interpreted by git as the –upload-pack option and executed via a shell. A
\nuser with permission to create or modify a project in a single organization can
\nthereby execute arbitrary commands on the control-plane task pod, with output
\nreflected through the project update stdout endpoint, leading to cross-tenant
\ncompromise and in-cluster lateral movement<\/p>\n","protected":false},"excerpt":{"rendered":"
A flaw was found in Red Hat Ansible Automation Platform’s automation-
\ncontroller. The Project scm_url field is not validated against values that
\nbegin with a dash and is stored and passed verbatim to <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28133","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28133","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}