Описание
A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda.
Отчет
This issue is classified as Moderate because the exploitation conditions significantly limit its practicality and impact in typical deployments. Successful exploitation requires the attacker to first obtain a valid CSRF form token tied to the victim’s session, which is generally protected by browser same-origin policies and modern CSRF mitigations—making token theft non-trivial without an existing compromise or major misconfiguration. Additionally, the gateway is still performing Referer checks when TLS edge termination is in place, which, while not as strict as Origin validation, reduces exposure in many real-world setups. The need for a valid authenticated session and precise token alignment means the attacker cannot simply trick a user into visiting a malicious site and execute arbitrary state-changing requests; they must overcome multiple layered controls.
Меры по смягчению последствий
Use HTTPS on the platform ingress if possible. Since this is a problem in edge-terminated AAP deployments where requests have TLS terminated right before the platform ingress, enforce trusted origins before requests reach the gateway. A tool such as a Web-application firewall should be able to manage this issue.
Дополнительная информация
Статус:
5.3 Medium
CVSS3
Связанные уязвимости
A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda.
A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda.
5.3 Medium
CVSS3