fetch module path traversal

[samdoran]

SUMMARY

CVE-2020-1735

Possibly related to CVE-2019-3828 (#52133)

The fetch module takes the source result from the slurp module, which came from the remote host. We don't really validate this path and it could have been manipulated by the remote host in a malicious way such that we end up a path similar to /tmp/result_fetch/ansible1/../../../../../../../../../../../../../../../../home/<user>/.profile for the source. This allows an attacker to place a file the contents of which they control.

Relevant Code:

ansible/lib/ansible/plugins/action/fetch.py

Lines 83 to 102 in 79dfae9

	slurpres = self._execute_module(module_name='slurp', module_args=dict(src=source), task_vars=task_vars)
	if slurpres.get('failed'):
	if not fail_on_missing and (slurpres.get('msg').startswith('file not found') or remote_checksum == '1'):
	result['msg'] = "the remote file does not exist, not transferring, ignored"
	result['file'] = source
	result['changed'] = False
	else:
	result.update(slurpres)
	return result
	else:
	if slurpres['encoding'] == 'base64':
	remote_data = base64.b64decode(slurpres['content'])
	if remote_data is not None:
	remote_checksum = checksum_s(remote_data)
	# the source path may have been expanded on the
	# target system, so we compare it here and use the
	# expanded version if it's different
	remote_source = slurpres.get('source')
	if remote_source and remote_source != source:
	source = remote_source

Suggested correction from the reporter:

• Don't use %s/%s/%s to compute the destination file or clean the last argument
• add the following check:

target_dir = os.path.normpath(os.path.join(self._loader.path_dwim(dest), target_name))
dest = os.path.normpath(os.path.join(target_dir, source_local)
assert os.path.commonpath([target_dir, dest]) == target_dir

ISSUE TYPE

• Bug Report

COMPONENT NAME

lib/ansible/plugins/action/fetch.py

ANSIBLE VERSION

2.10

CONFIGURATION

default

OS / ENVIRONMENT

STEPS TO REPRODUCE

EXPECTED RESULTS

ACTUAL RESULTS

[samdoran]

os.path.commonpath() was added in Python 3.4 but is not available in Python 2.7, so we cannot use that. os.path.commonprefix() is available in Python 2.7 and should work, though.

[bcoca]

we can just remove those lines since we already do remote-expand previously, there is no need to use the return from slurp.