CVE-2024-9902

What it actually does

An unprivileged user can cause the ansible-core user module, when executed by a privileged user against the unprivileged user's home directory, to silently create, replace, or take ownership of arbitrary files on any system path if the attacker has directory traversal permissions to the target.

Why it matters to the business

Attackers can tamper with critical system files or configuration on managed hosts, leading to unauthorized access, data integrity loss, or further compromise; the issue affects a very small number of downstream systems and has no active exploitation campaigns.

How an attack unfolds

An attacker with a low-privileged account prepares a home directory containing a symlink or path traversal that points to a desired target file; when an administrator later runs the user module to manage that account, the module follows the path and writes or chown's the target file under the attacker's control.

How to fix it

Upgrade salt packages on Ubuntu 14.04 LTS to 0.17.5+ds-1ubuntu0.1~esm1 and on Ubuntu 16.04 LTS to 2015.8.1+ds-2; apply the fixed versions immediately on any remaining affected systems.

How to confirm the fix worked

Confirm package versions match the listed fixed releases using the distribution package manager; test the user module against a non-privileged account in a lab environment and verify that attempts to influence external paths are rejected.

Typical attack path

1. Obtain low-privileged local account on a managed system
2. Create a directory structure with traversal permissions leading to a high-value target file
3. Wait for or induce a privileged user to execute the user module against the account's home directory
4. Gain ownership or contents control of the target file for persistence or escalation

How to detect it

Review automation logs and module execution history for unexpected file ownership changes or writes to sensitive paths originating from user module runs; correlate with user account creation or modification events.

What your security team should do

• Patch all remaining Ubuntu 14.04 and 16.04 systems running salt to the stated fixed versions without delay
• Audit playbooks and automation that invoke the user module and restrict execution to trusted operators
• Monitor for any new reports of exploitation despite low EPSS and absence from KEV