CVE-2017-7481 (Python, published 2018-07-19T13:29Z)
Description: value: Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/ansible/ansible
Files changed:
docs/docsite/rst/intro_configuration.rst
examples/ansible.cfg
lib/ansible/constants.py
lib/ansible/template/__init__.py
Commit message: Fixing security issue with lookup returns not tainting the jinja2 environment

CVE-2017-7481

Lookup returns wrap the result in unsafe, however when used through the
standard templar engine, this does not result in the jinja2 environment being
marked as unsafe as a whole. This means the lookup result looses the unsafe
protection and may become simple unicode strings, which can result in bad
things being re-templated.

This also adds a global lookup param and cfg options for lookups to allow
unsafe returns, so users can force the previous (insecure) behavior.


Vulnerable code:
# Controlls which files to ignore when using a directory as inventory with
            if ran:
            new_context = t.new_context(jvars, shared=True)

Fixed code:
.. _allow_unsafe_lookups:

allow_unsafe_lookups
====================

.. versionadded:: 2.2.3, 2.3.1

When enabled, this option allows lookup plugins (whether used in variables as `{{lookup('foo')}}` or as a loop as `with_foo`) to return data that is **not** marked "unsafe". By default, such data is marked as unsafe to prevent the templating engine from evaluating any jinja2 templating language, as this could represent a security risk.

This option is provided to allow for backwards-compatibility, however users should first consider adding `allow_unsafe=True` to any lookups which may be expected to contain data which may be run through the templating engine later. For example::

    {{lookup('pipe', '/path/to/some/command', allow_unsafe=True)}}


# Controls which files to ignore when using a directory as inventory with
# When enabled, this option allows lookups (via variables like {{lookup('foo')}} or when used as
# a loop with `with_foo`) to return data that is not marked "unsafe". This means the data may contain
# jinja2 templating language which will be run through the templating engine.
# ENABLING THIS COULD BE A SECURITY RISK
#allow_unsafe_lookups = False

DEFAULT_ALLOW_UNSAFE_LOOKUPS = get_config(p, DEFAULTS, 'allow_unsafe_lookups', None, False, value_type='boolean')
        # the current rendering context under which the templar class is working
        self.cur_context = None

            allow_unsafe = kwargs.pop('allow_unsafe', C.DEFAULT_ALLOW_UNSAFE_LOOKUPS)
            if ran and not allow_unsafe:
                from ansible.vars.unsafe_proxy import UnsafeProxy, wrap_var
                if self.cur_context:
                    self.cur_context.unsafe = True
            self.cur_context = new_context = t.new_context(jvars, shared=True)