Automation-controller: automation-controller-container: automation-controller: notification template jinja whitelist bypass via conditional gating leaks tracebacks
5Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 2.7
probabilidad de explotación
—
explotación observada
noninguna fuente lo reporta
Notification template Jinja AST whitelist only inspects
static Getattr nodes. Dynamic subscripts (job['job'+'_env'])
and {% if job.id > 100 %} conditional gating bypass both
the AST check and the test-render (stub has small job.id).
At runtime, the gated branch executes and exceptions write
full tracebacks into notification body, which is POSTed
to attacker-controlled webhook URL. Leaks install paths,
Python version, source line numbers.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Productos afectados
Red Hat · Red Hat Ansible Automation Platform 2