CVE-2021-4041: Ansible Runner RCE Vulnerability

CVE-2021-4041 Overview

A command injection vulnerability was discovered in Red Hat Ansible Runner where improper escaping of shell commands in the ansible_runner.interface.run_command function can lead to arbitrary command execution on the host system. The flaw allows parameters intended for virtual environment execution to be interpreted and executed as shell commands on the host machine, potentially enabling attackers to compromise systems running vulnerable versions of Ansible Runner.

Critical Impact

Developers may unintentionally write code that gets executed directly on the host system rather than within the intended virtual environment, leading to potential host compromise with high confidentiality, integrity, and availability impact.

Affected Products

• Red Hat Ansible Runner (versions prior to security patch)
• Red Hat Ansible Runner 2.1.0-alpha1
• Red Hat Ansible Runner 2.1.0-alpha2
• Red Hat Ansible Runner 2.1.0-beta1

Discovery Timeline

• 2022-08-24 - CVE CVE-2021-4041 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-4041

Vulnerability Analysis

This vulnerability stems from improper output encoding (CWE-116) and insufficient input validation (CWE-20) in Ansible Runner's subprocess handling. The flaw occurs when shell commands are constructed using string concatenation or formatting without proper escaping, allowing specially crafted input to break out of the intended command context and execute arbitrary commands on the host system.

The vulnerability is exploitable through local access and requires user interaction, as a developer must write or execute code that passes malicious input to the vulnerable functions. When exploited, an attacker can achieve full compromise of the host system's confidentiality, integrity, and availability.

Root Cause

The root cause lies in the use of shell=True in subprocess calls combined with improper command argument construction. The vulnerable code concatenated arguments into a single string that was then passed to a shell for interpretation. This allows shell metacharacters in user-supplied input to be interpreted by the shell, enabling command injection.

Specifically, the code used patterns like " ".join(plugin_names) to construct arguments and passed commands as formatted strings to Popen with shell=True, rather than using argument lists with shell execution disabled.

Attack Vector

The attack requires local access where an attacker or malicious code can influence parameters passed to ansible_runner.interface.run_command. By injecting shell metacharacters (such as ;, |, $(), or backticks) into arguments, an attacker can append or inject arbitrary commands that execute with the privileges of the Ansible Runner process.

The following patch demonstrates how the vulnerability was addressed by removing shell usage in subprocess calls:

         if module_path:
             self.cmdline_args.extend(['-M', module_path])
 
-        self.cmdline_args.append(" ".join(plugin_names))
+        self.cmdline_args.extend(plugin_names)
 
         self.command = [self._ansible_doc_exec_path] + self.cmdline_args
         self._handle_command_wrap(self.execution_mode, self.cmdline_args)

Source: GitHub Ansible Runner Commit

The cgroup creation code was similarly patched:

             user = getpass.getuser()
             group = grp.getgrgid(os.getgid()).gr_name
 
-            cmd = 'cgcreate -a {user}:{group} -t {user}:{group} -g cpuacct,memory,pids:{}'.format(cgroup_path, user=user, group=group)
-            proc = Popen(cmd, stdout=PIPE, stderr=PIPE, shell=True)
+            cmd = ['cgcreate',
+                   '-a', f'{user}:{group}',
+                   '-t', f'{user}:{group}',
+                   '-g', f'cpuacct,memory,pids:{cgroup_path}',
+                   ]
+            proc = Popen(cmd, stdout=PIPE, stderr=PIPE)
             _, stderr = proc.communicate()
             if proc.returncode:
                 # Unable to create cgroup

Source: GitHub Ansible Runner Commit

Detection Methods for CVE-2021-4041

Indicators of Compromise

• Unexpected shell processes spawned as children of Ansible Runner processes
• Unusual command executions in system logs containing shell metacharacters (;, |, $(, backticks)
• Anomalous network connections or file system modifications originating from Ansible Runner execution contexts
• Process execution chains showing commands not typically associated with Ansible playbook operations

Detection Strategies

• Monitor subprocess creation from Ansible Runner processes for unexpected command patterns
• Implement logging for all ansible_runner.interface.run_command invocations with parameter inspection
• Use process monitoring tools to detect shell command injection patterns in Ansible Runner arguments
• Deploy file integrity monitoring on systems running Ansible Runner to detect unauthorized modifications

Monitoring Recommendations

• Enable detailed audit logging for Ansible Runner operations and subprocess executions
• Configure SIEM rules to alert on shell metacharacters in Ansible-related process arguments
• Implement behavioral analysis to establish baseline Ansible Runner execution patterns
• Monitor for privilege escalation attempts following Ansible Runner process execution

How to Mitigate CVE-2021-4041

Immediate Actions Required

• Update Ansible Runner to a patched version that includes commit 3533f265f4349a3f2a0283158cd01b59a6bbc7bd
• Audit any custom code that interfaces with ansible_runner.interface.run_command for proper input sanitization
• Review Ansible Runner deployments for exposure to untrusted input sources
• Implement input validation on all parameters passed to Ansible Runner functions

Patch Information

Red Hat has released security updates to address this vulnerability. The fix modifies subprocess calls to use argument lists instead of shell string interpolation, eliminating the command injection vector. The security patch is available through the GitHub Ansible Runner Commit.

For detailed information, consult the Red Hat CVE-2021-4041 Advisory and Red Hat Bug Report #2028074.

Workarounds

• Restrict Ansible Runner execution to trusted environments with controlled input sources
• Implement strict input validation and sanitization for any user-controlled data passed to Ansible Runner
• Run Ansible Runner in isolated containers or sandboxed environments to limit impact of potential exploitation
• Apply principle of least privilege to Ansible Runner service accounts

# Verify Ansible Runner version and check for vulnerable code patterns
pip show ansible-runner | grep Version

# Search for potentially vulnerable shell=True usage in custom code
grep -r "shell=True" /path/to/ansible/code/

# Review subprocess calls in Ansible Runner installation
grep -r "Popen.*shell" $(python -c "import ansible_runner; print(ansible_runner.__path__[0])")