Ansible Automation Platform EDA Component Git Argument Injection Vulnerability

A vulnerability exists in the Event-Driven Ansible (EDA) component of Ansible Automation Platform, where user-provided Git URLs are sent unvalidated to the 'git ls-remote' command. This flaw allows an authenticated attacker to inject arguments and execute arbitrary commands on the EDA worker. In Kubernetes or OpenShift environments, this could result in the theft of service account tokens and unauthorized access to the cluster.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution on the EDA worker, with potential access to sensitive Kubernetes or OpenShift resources, including service account tokens and associated secrets.