Insecure WebSocket Connection in Ansible Rulebook EDA Server Exposes System Data

CVE-2024-1657

Summary

A vulnerability has been identified in the Ansible Automation Platform where an insecure WebSocket connection is utilized during the installation process from the Ansible rulebook EDA server. This security flaw allows an attacker with access to any machine within the same CIDR block to exploit the WebSocket, potentially leading to unauthorized downloading of all rulebook data. As a result, this vulnerability poses significant risks to the confidentiality and integrity of the system, enabling sensitive data exposures and unauthorized access to critical automation resources. Organizations using Ansible Automation Platform are advised to take immediate action to secure their WebSocket configurations and mitigate potential risks.

References