CVE-2024-36110: Ansibleguy-webui XSS Vulnerability

CVE-2024-36110 Overview

CVE-2024-36110 is a stored Cross-Site Scripting (XSS) vulnerability affecting ansibleguy-webui, an open source WebUI for running Ansible automation. Versions prior to 0.0.21 accepted HTML content in multiple form inputs without sanitization. The injected markup is returned to users after job actions execute, causing browsers to render attacker-controlled HTML and script. The maintainers addressed the flaw in version 0.0.21 (0.0.21.post2 on PyPI). The issue is tracked under CWE-79 and GitHub Security Advisory GHSA-927p-xrc2-x2gj.

Critical Impact
Authenticated attackers can inject persistent HTML and JavaScript into ansibleguy-webui forms, allowing session theft, action hijacking, and privilege escalation against manager and administrator users who review job output.

Affected Products

ansibleguy-webui versions < 0.0.21
Python package ansibleguy-webui on PyPI prior to 0.0.21.post2
Deployments exposing the WebUI to multi-user or manager-privileged access

Discovery Timeline

2024-05-28 - CVE-2024-36110 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-36110

Vulnerability Analysis

The vulnerability is a stored XSS issue [CWE-79] in multiple ansibleguy-webui form endpoints. User-supplied fields, including alert configuration values processed by aw/api_endpoints/alert.py, were stored without HTML escaping. When the WebUI later rendered job action responses, the browser evaluated the persisted markup as active content.

The scope-changed impact allows an attacker with low privileges to influence sessions of higher-privileged users who view the same objects. Practical outcomes include cookie exfiltration, forced API calls under the victim's session, and manipulation of Ansible job triggers.

Root Cause

The API layer accepted arbitrary characters in form fields and returned those values verbatim in JSON responses consumed by the frontend. There was no server-side HTML escaping and no dedicated validator to reject markup or script tokens. The absence of a validate_no_xss helper and consistent use of Django's escape function across serializers allowed persistent injection.

Attack Vector

An authenticated user submits a crafted payload containing HTML or <script> tags through vulnerable forms such as alert creation. The payload is stored in the database and returned to any user who executes or reviews the associated job action. The browser then renders the payload in the context of the WebUI origin.

python

# Security patch: src/ansibleguy-webui/aw/api_endpoints/alert.py
 from aw.model.job import Job
 from aw.api_endpoints.base import API_PERMISSION, GenericResponse, get_api_user, api_docs_put, api_docs_delete, \
-    api_docs_post
+    api_docs_post, validate_no_xss
 from aw.utils.permission import has_manager_privileges
 from aw.model.alert import BaseAlert, AlertPlugin, AlertGlobal, AlertGroup, AlertUser

Source: GitHub Commit 7737b47

python

# Security patch: src/ansibleguy-webui/aw/api_endpoints/base.py
 from django.contrib.auth.models import AnonymousUser
 from django.core.exceptions import ObjectDoesNotExist
 from django.http import JsonResponse
+from django.utils.html import escape as escape_html
 from rest_framework import serializers
+from rest_framework.exceptions import ValidationError
 from rest_framework.permissions import IsAuthenticated
 from rest_framework_api_key.permissions import BaseHasAPIKey
 from drf_spectacular.utils import OpenApiResponse

 from aw.model.api import AwAPIKey
 from aw.base import USERS, GROUPS
+from aw.utils.util import is_set

Source: GitHub Commit 7737b47. The patch introduces escape_html and a validate_no_xss validator wired into the base API endpoints module.

Detection Methods for CVE-2024-36110

Indicators of Compromise

Alert, job, or form records containing <script>, onerror=, onload=, or javascript: tokens in string fields.
Unexpected outbound requests from browser sessions of manager or admin accounts shortly after opening a job or alert view.
New or modified alert configurations created by low-privilege accounts that target administrator-visible views.

Detection Strategies

Query the ansibleguy-webui database for stored fields matching HTML tag or event-handler regular expressions.
Review WebUI application logs and reverse proxy access logs for POST requests to /api/alert and related form endpoints containing angle brackets or encoded script payloads.
Compare the deployed package version against 0.0.21.post2 using pip show ansibleguy-webui.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting on the WebUI reverse proxy to capture inline script violations.
Alert on privileged user sessions issuing unusual API calls immediately after loading pages that display user-supplied fields.
Forward WebUI and proxy logs to a centralized analytics pipeline and correlate authentication events with anomalous DOM-driven requests.

How to Mitigate CVE-2024-36110

Immediate Actions Required

Upgrade ansibleguy-webui to version 0.0.21.post2 or later using pip install --upgrade ansibleguy-webui.
Audit existing alert, job, and form records for stored HTML or script content and remove or sanitize entries.
Rotate session cookies and API keys for any account that may have viewed attacker-influenced records.

Patch Information

The fix is delivered in ansibleguy-webui 0.0.21 (PyPI release 0.0.21.post2). Commit 7737b47 introduces validate_no_xss and imports Django's escape helper into aw/api_endpoints/base.py, applying escaping and validation across affected endpoints. Full details are in GitHub Security Advisory GHSA-927p-xrc2-x2gj and GitHub Issue #44 Discussion.

Workarounds

No official workarounds exist; upgrading is the only supported remediation per the advisory.
Restrict WebUI access to trusted operators and remove manager privileges from unnecessary accounts until the patch is applied.
Deploy a strict Content Security Policy at the reverse proxy to block inline script execution as a defense-in-depth measure.

bash

# Upgrade ansibleguy-webui to the patched release
pip install --upgrade 'ansibleguy-webui>=0.0.21.post2'

# Verify installed version
pip show ansibleguy-webui | grep -i version

# Search stored data for potential injected markup (example: SQLite backend)
sqlite3 /path/to/aw.db "SELECT id, name FROM aw_basealert WHERE name LIKE '%<%' OR name LIKE '%javascript:%';"