CVE-2024-1057: 
WordPress vulnerability analysis and mitigation

A flaw was discovered in the Red Hat Ansible Automation Platform where an insecure WebSocket connection was being used in installation from the Ansible rulebook EDA server. The vulnerability is tracked as CVE-2024-1657 and has been rated as Important with a CVSS v3 base score of 8.1 (Red Hat CVE).

The vulnerability stems from an insecure WebSocket implementation in the EDA (Event-Driven Ansible) server component. The technical issue involves improper restriction of communication channels to intended endpoints (CWE-923) and missing origin validation in WebSockets (CWE-1385). The CVSS vector for this vulnerability is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, indicating network accessibility with low attack complexity (Red Hat CVE).

An attacker with access to any machine in the CIDR block could potentially download all rulebook data from the WebSocket, resulting in loss of confidentiality and integrity of the system. The vulnerability affects the confidentiality and integrity of the data while having no direct impact on system availability (Red Hat CVE).

The vulnerability requires network access and low privileges for exploitation. No user interaction is required once an attacker has the necessary access, making it relatively straightforward to exploit for attackers who can reach the affected system (Red Hat CVE).

Red Hat has released security updates to address this vulnerability in Ansible Automation Platform 2.4. The fix is included in automation-eda-controller version 1.0.5. After upgrading EDA Controller, all existing running activations must be restarted with upgraded Decision Environment images (Red Hat Advisory).