Arbitrary Code Injection

2023-09-0208:25:06

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

vulnerability

ansible semaphore

code injection

remote attacker

extra variables

0.001 Low

EPSS

Percentile

47.1%

JSON

github.com/ansible-semaphore/semaphore is vulnerable to Arbitrary Code Injection. The vulnerability exists in makeCmd function at AnsiblePlaybook.go which allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables parameter.

CPENameOperatorVersion
github.com/ansible-semaphore/semaphorelev2.8.101
github.com/ansible-semaphore/semaphorelev2.8.101

CPE	Name	Operator	Version
	github.com/ansible-semaphore/semaphore	le	v2.8.101
	github.com/ansible-semaphore/semaphore	le	v2.8.101

References

gist.github.com/Alevsk/1757da24c5fb8db735d392fd4146ca3a

github.com/advisories/GHSA-3r32-cp7v-5wq4

github.com/ansible-semaphore/semaphore/blob/develop/lib/AnsiblePlaybook.go#L19

www.alevsk.com/2023/07/a-quick-story-of-security-pitfalls-with-execcommand-in-software-integrations/

0.001 Low

EPSS

Percentile

47.1%

JSON

Related for VERACODE:43084