Problem: RCE by leveraging extra-vars

[simonvik]

Versions

Scope

Unknown

Issue

It might not be a problem depending on the security model but it can in theory allow someone to gain more access than they should have.

See: GHSA-4839-8mxx-4xr9

[ansibleguy]

Greetings!

Should at least be mentioned in the docs, yeah.
As I see it - even allowing users to execute playbooks is by design a RCE in the context of the executing user. (when target is localhost)

[superstes]

Could be nice-to-have to allow a specific runner user. So the execution context is separated from the WebUI context. (Setting in System config)

P.E. User ansible-webui is running the WebUI and ansible-runner user is executing commands
The WebUI user will need system privileges to become the runner user.

[ansibleguy]

Could be nice-to-have to allow a specific runner user. So the execution context is separated from the WebUI context. (Setting in System config)

Would be doable if ansible-runner would allow us to specify the subprocess-user (currently not possible).
I've created a feature-request in the ansible-runner repo to find out if they would be OK with adding support for it.