CVE-2015-6240 (Python, published 2017-06-07T20:29Z)
Description: value: The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack.
Severity: HIGH (CVSS v3 base score: 7.8)
Weakness: CWE-59 \u2014 Improper Link Resolution Before File Access ('Link Following')
The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Repository: https://github.com/ansible/ansible
Files changed:
lib/ansible/plugins/connections/jail.py
lib/ansible/plugins/connections/zone.py
Commit message: Fix problem with jail and zone connection plugins and symlinks from within the jail/zone.


Vulnerable code:
import shutil
    ''' Local chroot based connections '''
        ''' connect to the chroot; nothing to do here '''
        vvv("THIS IS A LOCAL CHROOT DIR", host=self.jail)
    def exec_command(self, cmd, tmp_path, become_user=None, sudoable=False, executable='/bin/sh', in_data=None):
        ''' run a command on the chroot '''
                             stdin=subprocess.PIPE,
    def _normalize_path(self, path, prefix):
        if not path.startswith(os.path.sep):
            path = os.path.join(os.path.sep, path)
        normpath = os.path.normpath(path)
        return os.path.join(prefix, normpath[1:])

    def _copy_file(self, in_path, out_path):
        if not os.path.exists(in_path):
            raise errors.AnsibleFileNotFound("file or module does not exist: %s" % in_path)
        try:
            shutil.copyfile(in_path, out_path)
        except shutil.Error:
            traceback.print_exc()
            raise errors.AnsibleError("failed to copy: %s and %s are the same" % (in_path, out_path))
        except IOError:
            traceback.print_exc()
            raise errors.AnsibleError("failed to transfer file to %s" % out_path)

        ''' transfer a file from local to chroot '''
        out_path = self._normalize_path(out_path, self.get_jail_path())
        self._copy_file(in_path, out_path)
        ''' fetch a file from chroot to local '''
        in_path = self._normalize_path(in_path, self.get_jail_path())
        self._copy_file(in_path, out_path)
import shutil
from subprocess import Popen,PIPE
        #stdout, stderr = p.communicate()
    def exec_command(self, cmd, tmp_path, become_user=None, sudoable=False, executable=None, in_data=None):
        ''' run a command on the zone '''
        if executable == '/bin/sh':
          executable = None
                             stdin=subprocess.PIPE,
    def _normalize_path(self, path, prefix):
        if not path.startswith(os.path.sep):
            path = os.path.join(os.path.sep, path)
        normpath = os.path.normpath(path)
        return os.path.join(prefix, normpath[1:])

    def _copy_file(self, in_path, out_path):
        if not os.path.exists(in_path):
            raise errors.AnsibleFileNotFound("file or module does not exist: %s" % in_path)
        try:
            shutil.copyfile(in_path, out_path)
        except shutil.Error:
            traceback.print_exc()
            raise errors.AnsibleError("failed to copy: %s and %s are the same" % (in_path, out_path))
        except IOError:
            traceback.print_exc()
            raise errors.AnsibleError("failed to transfer file to %s" % out_path)

        out_path = self._normalize_path(out_path, self.get_zone_path())
        self._copy_file(in_path, out_path)
        in_path = self._normalize_path(in_path, self.get_zone_path())
        self._copy_file(in_path, out_path)

Fixed code:
# (c) 2015, Toshio Kuratomi <tkuratomi@ansible.com>
BUFSIZE = 4096

    ''' Local BSD Jail based connections '''
        ''' connect to the jail; nothing to do here '''
        vvv("THIS IS A LOCAL JAIL DIR", host=self.jail)
    def _buffered_exec_command(self, cmd, tmp_path, become_user=None, sudoable=False, executable='/bin/sh', in_data=None, stdin=subprocess.PIPE):
        ''' run a command on the jail.  This is only needed for implementing
        put_file() get_file() so that we don't have to read the whole file
        into memory.

        compared to exec_command() it looses some niceties like being able to
        return the process's exit code immediately.
        '''
                             stdin=stdin,
        return p

    def exec_command(self, cmd, tmp_path, become_user=None, sudoable=False, executable='/bin/sh', in_data=None):
        ''' run a command on the jail '''

        p = self._buffered_exec_command(cmd, tmp_path, become_user, sudoable, executable, in_data)

        ''' transfer a file from local to jail '''
        with open(in_path, 'rb') as in_file:
            p = self._buffered_exec_command('dd of=%s' % out_path, None, stdin=in_file)
            try:
                stdout, stderr = p.communicate()
            except:
                traceback.print_exc()
                raise errors.AnsibleError("failed to transfer file to %s" % out_path)
            if p.returncode != 0:
                raise errors.AnsibleError("failed to transfer file to %s:\n%s\n%s" % (out_path, stdout, stderr))
        ''' fetch a file from jail to local '''

        p = self._buffered_exec_command('dd if=%s bs=%s' % (in_path, BUFSIZE), None)

        with open(out_path, 'wb+') as out_file:
            try:
                for chunk in p.stdout.read(BUFSIZE):
                    out_file.write(chunk)
            except:
                traceback.print_exc()
                raise errors.AnsibleError("failed to transfer file to %s" % out_path)
            stdout, stderr = p.communicate()
            if p.returncode != 0:
                raise errors.AnsibleError("failed to transfer file to %s:\n%s\n%s" % (out_path, stdout, stderr))
# (c) 2015, Toshio Kuratomi <tkuratomi@ansible.com>
BUFSIZE = 4096


            ### TODO: Why was "-c" removed from here? (vs jail.py)
    def _buffered_exec_command(self, cmd, tmp_path, become_user=None, sudoable=False, executable=None, in_data=None, stdin=subprocess.PIPE):
        ''' run a command on the zone.  This is only needed for implementing
        put_file() get_file() so that we don't have to read the whole file
        into memory.

        compared to exec_command() it looses some niceties like being able to
        return the process's exit code immediately.
        '''
                             stdin=stdin,
        return p

    def exec_command(self, cmd, tmp_path, become_user=None, sudoable=False, executable=None, in_data=None):
        ''' run a command on the zone '''

        ### TODO: Why all the precautions not to specify /bin/sh? (vs jail.py)
        if executable == '/bin/sh':
          executable = None

        p = self._buffered_exec_command(cmd, tmp_path, become_user, sudoable, executable, in_data)

        with open(in_path, 'rb') as in_file:
            p = self._buffered_exec_command('dd of=%s' % out_path, None, stdin=in_file)
            try:
                stdout, stderr = p.communicate()
            except:
                traceback.print_exc()
                raise errors.AnsibleError("failed to transfer file to %s" % out_path)
            if p.returncode != 0:
                raise errors.AnsibleError("failed to transfer file to %s:\n%s\n%s" % (out_path, stdout, stderr))

        p = self._buffered_exec_command('dd if=%s bs=%s' % (in_path, BUFSIZE), None)

        with open(out_path, 'wb+') as out_file:
            try:
                for chunk in p.stdout.read(BUFSIZE):
                    out_file.write(chunk)
            except:
                traceback.print_exc()
                raise errors.AnsibleError("failed to transfer file to %s" % out_path)
            stdout, stderr = p.communicate()
            if p.returncode != 0:
                raise errors.AnsibleError("failed to transfer file to %s:\n%s\n%s" % (out_path, stdout, stderr))