An argument-injection flaw was found in the Ansible Automation Platform automation-controller
system-job subsystem. The system-job template launch endpoint stores a user-supplied "days"
variable without running the integer validation defined elsewhere for that field, and the
dispatcher flattens the management-command argument list into a single string with spaces before
the job runner re-splits it, so spaces in the value become additional command-line arguments. Because system jobs are executed in-process on the control node without the container isolation
applied to all other job types, an authenticated user with superuser privileges can inject
arbitrary arguments — including Python's path option — into the control-plane awx-manage process,
controlling its argument vector and the first entry of its module search path.
Full remote code
execution requires an additional import gadget that is not present in the current management
commands, so the demonstrated impact is argument injection with control of the process search
path rather than confirmed code execution.
Attack Parameters
Impact Assessment
CVSS Vector v3.1