Описание
A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref names (branch/tag names) into shell commands executed via subprocess.run() with shell=True. An authenticated user who controls a git repository can create a branch or tag with shell metacharacters in the name to achieve remote code execution on the pulp worker. The vulnerable endpoint is only reachable when GALAXY_ENABLE_LEGACY_ROLES is set to True, which is not the default configuration.
Отчет
Red Hat Ansible Automation Platform ships galaxy_ng with GALAXY_ENABLE_LEGACY_ROLES set to False by default in all supported versions (2.4, 2.5, 2.6). When this setting is False, the vulnerable v1 API endpoint is not registered and returns a 404 response, making the vulnerability unreachable. Standard AAP deployments are not affected. Customers who have explicitly enabled legacy role support (GALAXY_ENABLE_LEGACY_ROLES=True) should apply the mitigation steps above until a fix is available.
Меры по смягчению последствий
The following practices would help for avoiding exposure and mitigate this flaw:
- Ensure that GALAXY_ENABLE_LEGACY_ROLES is set to False (the default) in your Galaxy/Hub configuration. This prevents the v1 API routes from being registered, making the vulnerable endpoint entirely unreachable.
- If legacy role support must be enabled, restrict access to the Galaxy/Hub API to trusted users only. The vulnerability requires authentication, so limiting who can authenticate reduces exposure.
- Monitor import activity for suspicious git references containing shell metacharacters in branch or tag names.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-24/hub-rhel8 | Not affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-25/hub-rhel8 | Affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-26/hub-rhel9 | Affected | ||
| Red Hat Ansible Automation Platform 2 | ansible-automation-platform-27/hub-rhel9 | Affected | ||
| Red Hat Ansible Automation Platform 2 | automation-hub | Affected | ||
| Red Hat Ansible Automation Platform 2 | python3.11-galaxy-ng | Under investigation | ||
| Red Hat Ansible Automation Platform 2 | python3.12-galaxy-ng | Under investigation | ||
| Red Hat Ansible Automation Platform 2 | python3x-galaxy-ng | Under investigation | ||
| Red Hat Ansible Automation Platform 2 | python-galaxy-ng | Under investigation |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
A command injection vulnerability was found in galaxy_ng. The do_git_checkout() function in the legacy role import API (v1) interpolates unsanitized git ref names (branch/tag names) into shell commands executed via subprocess.run() with shell=True. An authenticated user who controls a git repository can create a branch or tag with shell metacharacters in the name to achieve remote code execution on the pulp worker. The vulnerable endpoint is only reachable when GALAXY_ENABLE_LEGACY_ROLES is set to True, which is not the default configuration.
EPSS
7.5 High
CVSS3