prevent ansible_facts injection (#68431) (#68446)

* prevent ansible_facts injection (#68431)

- also only replace when needed
 - switched from replace to index
 - added test to verify bogus_facts are not accepted

CVE-2020-10684

(cherry picked from commit a9d2ceafe4)

* add to ignore

changelogs/fragments/af_clean.yml

@@ -0,0 +1,2 @@
+bugfixes:
+    - Ensure we don't allow ansible_facts subkey of ansible_facts to override top level, also fix 'deprefixing' to prevent key transforms.

lib/ansible/constants.py

@@ -112,7 +112,7 @@ INTERNAL_RESULT_KEYS = ('add_host', 'add_group')
 LOCALHOST = ('127.0.0.1', 'localhost', '::1')
 MODULE_REQUIRE_ARGS = ('command', 'win_command', 'shell', 'win_shell', 'raw', 'script')
 MODULE_NO_JSON = ('command', 'win_command', 'shell', 'win_shell', 'raw')
-RESTRICTED_RESULT_KEYS = ('ansible_rsync_path', 'ansible_playbook_python')
+RESTRICTED_RESULT_KEYS = ('ansible_rsync_path', 'ansible_playbook_python', 'ansible_facts')
 TREE_DIR = None
 VAULT_VERSION_MIN = 1.0
 VAULT_VERSION_MAX = 1.0

lib/ansible/vars/clean.py

@@ -156,10 +156,9 @@ def namespace_facts(facts):
     ''' return all facts inside 'ansible_facts' w/o an ansible_ prefix '''
     deprefixed = {}
     for k in facts:
-        if k in ('ansible_local',):
-            # exceptions to 'deprefixing'
-            deprefixed[k] = module_response_deepcopy(facts[k])
+        if k.startswith('ansible_') and k not in ('ansible_local',):
+            deprefixed[k[8:]] = module_response_deepcopy(facts[k])
         else:
-            deprefixed[k.replace('ansible_', '', 1)] = module_response_deepcopy(facts[k])
+            deprefixed[k] = module_response_deepcopy(facts[k])
 
     return {'ansible_facts': deprefixed}

test/integration/targets/gathering_facts/library/bogus_facts

@@ -0,0 +1,12 @@
+#!/bin/sh
+
+echo '{
+    "changed": false,
+    "ansible_facts": {
+        "ansible_facts": {
+            "discovered_interpreter_python": "(touch /tmp/pwned-$(date -Iseconds)-$(whoami) ) 2>/dev/null >/dev/null && /usr/bin/python",
+			"bogus_overwrite": "yes"
+         },
+         "dansible_iscovered_interpreter_python": "(touch /tmp/pwned-$(date -Iseconds)-$(whoami) ) 2>/dev/null >/dev/null && /usr/bin/python"
+    }
+}'

test/integration/targets/gathering_facts/runme.sh

@@ -7,3 +7,6 @@ ansible-playbook test_gathering_facts.yml -i inventory -v "$@"
 # ANSIBLE_CACHE_PLUGIN=base ansible-playbook test_gathering_facts.yml -i inventory -v "$@"
 
 ANSIBLE_GATHERING=smart ansible-playbook test_run_once.yml -i inventory -v "$@"
+
+# ensure clean_facts is working properly
+ansible-playbook test_prevent_injection.yml -i inventory -v "$@"

test/integration/targets/gathering_facts/test_prevent_injection.yml

@@ -0,0 +1,14 @@
+- name: Ensure clean_facts is working properly
+  hosts: facthost1
+  gather_facts: false
+  tasks:
+    - name: gather 'bad' facts
+      action: bogus_facts
+
+    - name: ensure that the 'bad' facts didn't polute what they are not supposed to
+      assert:
+        that:
+            - "'touch' not in discovered_interpreter_python|default('')"
+            - "'touch' not in ansible_facts.get('discovered_interpreter_python', '')"
+            - "'touch' not in ansible_facts.get('ansible_facts', {}).get('discovered_interpreter_python', '')"
+            - bogus_overwrite is undefined

test/sanity/code-smell/shebang.py

@@ -28,6 +28,7 @@ def main():
         'test/integration/targets/win_module_utils/library/legacy_only_new_way_win_line_ending.ps1',
         'test/integration/targets/win_module_utils/library/legacy_only_old_way_win_line_ending.ps1',
         'test/utils/shippable/timing.py',
+        'test/integration/targets/gathering_facts/library/bogus_facts',
     ])
 
     for path in sys.argv[1:] or sys.stdin.read().splitlines():