Semaphore Ui
Monthly
Remote code execution in Semaphore UI through 2.19.16 allows an authenticated user holding the task_runner role to escape the intended Ansible execution boundary by placing protected connection variables into a task's environment JSON. Supplying ansible_ssh_common_args with a ProxyCommand, or ansible_connection=local, makes Ansible run attacker-chosen commands as the Semaphore server process user, exposing encryption keys, SSH keys and other stored secrets. The project addressed the issue upstream in pull request #3888, but no tagged patched release number is stated in the available data, and no public exploit code was identified at time of analysis (CVSS 8.7 / assessed CVSS 3.1 8.8, CWE-915).
Remote code execution in Semaphore UI through 2.19.16 allows an authenticated user holding the task_runner role to escape the intended Ansible execution boundary by placing protected connection variables into a task's environment JSON. Supplying ansible_ssh_common_args with a ProxyCommand, or ansible_connection=local, makes Ansible run attacker-chosen commands as the Semaphore server process user, exposing encryption keys, SSH keys and other stored secrets. The project addressed the issue upstream in pull request #3888, but no tagged patched release number is stated in the available data, and no public exploit code was identified at time of analysis (CVSS 8.7 / assessed CVSS 3.1 8.8, CWE-915).