automation-controller: automation-controller-container: automation-controller: notification template password fields can be decrypted by a notification-template administrator by replaying encrypted values across subfields, exposing plaintext Slack, PagerDuty, Twilio, AWS SNS and Grafana credentials

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Notification template password fields are encrypted with a key derived from the secret key, the object primary key, and the field name, but not the subfield name, and the API returns the full ciphertext of a password subfield after the notification type is changed to one that does not define that subfield. A user with administrative access to a single notification template, but without any wider privilege, can switch the template type to reveal the stored ciphertext, replant that ciphertext into a webhook password field pointing at a server they control, and trigger a test notification. The controller decrypts the replayed ciphertext to the original plaintext and sends it to the attacker's server in an HTTP Basic authorization header, allowing recovery of Slack, PagerDuty, Twilio, AWS SNS, and Grafana credentials the administrator was only permitted to use, not read.

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

An attacker operating through a network path may attempt exploitation with elevated privileges. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.