Elijah Delee

A cleartext storage flaw was found in the AAP Gateway Operator. When reconciling an AutomationController, the operator reads the protected resource-server Secret (Secret/<aap-name>-resource-server, key controller resource server secret) and copies its plaintext value into the generated AutomationController custom resource under spec.extra settings (RESOURCE SERVER.SECRET KEY). Although the operator uses no log to keep the value out of its own logs, serializing it into the custom resource exposes it to any principal able to read the AutomationController CR without permission to read the backing Kubernetes Secret, breaking the expected OpenShift RBAC separation between the two resources. The value may also propagate into Kubernetes API/etcd storage, GitOps and Argo diffs and history, rendered manifests, support bundles, and audit data. The resource-server secret is intended for trusted Gateway-to-Controller service authentication, and its disclosure may allow a user to impersonate a trusted Controller service and reach privileged service-index APIs.

A flaw exists in the Event-Driven Ansible (EDA) Event Stream API that can lead to the exposure of sensitive client credentials and internal infrastructure headers. This exposure occurs through the `test headers` field when an event stream is in test mode. Potential consequences include the leakage of internal infrastructure details, accidental disclosure of user or system credentials, possible privilege escalation if high-value tokens are exposed, and persistent exposure of sensitive data to users with read access to the event stream. The API endpoint involved is the Event Stream API. The vulnerable parameter is `test headers`.

A flaw exists in Event-Driven Ansible (EDA) Event Streams that allows an authenticated user to access sensitive internal infrastructure headers, such as `X-Trusted-Proxy` and `X-Envoy-*`, and event stream URLs through specially crafted requests and job templates. An attacker could potentially exploit this by exfiltrating these headers to spoof trusted requests, escalate privileges, or inject malicious events. The vulnerability involves the manipulation of requests and job templates to reveal internal information.

A flaw exists in the route creation component of the Ansible Automation Platform Gateway. This allows for credential theft through the creation of misleading routes utilizing a double-slash (//) prefix within the `gateway path`. A malicious administrator, or one susceptible to social engineering, can configure a deceptive route to intercept and steal user credentials, potentially establishing persistent access or a backdoor, even after their permissions are removed. The vulnerability involves creating routes with a double-slash (//) prefix in the `gateway path` to intercept credentials.

A flaw was found in the Ansible aap-gateway, where concurrent requests handled by the gateway grpc service can result in concurrency issues due to race condition requests against the proxy. This issue potentially allows a less privileged user to obtain the JWT of a greater privileged user, enabling the server to be jeopardized. A user session or confidential data might be vulnerable.