rules-ansible

The 'pipe' lookup plugin executes arbitrary commands on the control node. Using it with untrusted or dynamically generated input is a severe command injection vulnerability. Avoid 'pipe' lookup unless the command is hardcoded and strictly controlled. Consider using 'ansible.builtin.command' or 'ansible.builtin.shell' on the target host if command execution is required.

The 'raw' module executes commands directly without Ansible's module infrastructure, bypassing safety features and making it extremely vulnerable to injection and difficult to manage securely. Use specific Ansible modules (e.g., 'ansible.builtin.command', 'ansible.builtin.script', 'ansible.builtin.package') instead.

The 'shell' module is highly susceptible to command injection and should be avoided. Prefer 'ansible.builtin.command' for simple commands or specific Ansible modules for complex tasks. If 'shell' is absolutely necessary, ensure all inputs are strictly sanitized or hardcoded, and consider using 'ansible.builtin.command' with 'creates' or 'removes' for idempotency.

A 'debug' task is potentially exposing sensitive information (e.g., password, secret, API key, token). Ensure 'no_log: true' is set on tasks that register sensitive output, and avoid debugging variables that contain sensitive data. Use 'ansible-vault' for managing secrets.

Using Fully Qualified Collection Names (FQCN) like 'ansible.builtin.command' improves clarity, avoids ambiguity, and future-proofs playbooks. While not a direct security vulnerability, it's a strong best practice that prevents unexpected module resolution and aligns with modern Ansible style guides. Please use FQCN for all modules.

RISK: hardcoded sudo/become password in a playbook or group_vars file. If this file is committed to version control or shared, the privileged credential is exposed. FIX: store become passwords in an ansible-vault encrypted vars file (ansible-vault encrypt_string) or retrieve them from a secrets manager at runtime via a lookup plugin (e.g., lookup('community.hashi_vault.hashi_vault', ...)).

A task using 'ansible.builtin.uri' with a 'password' parameter does not have 'no_log: true' set. This can expose sensitive credentials in Ansible logs. Add 'no_log: true' to the task to prevent logging of sensitive data.

RISK: plaintext secret in group_vars or host_vars. These files are typically committed to git, making the secret visible to anyone with repository access. FIX: encrypt sensitive values with ansible-vault ('ansible-vault encrypt_string "value" --name variable_name') and commit only the '$ANSIBLE_VAULT;...' ciphertext. For new secrets, use a vault-encrypted vars file.

The 'dest' parameter in 'ansible.builtin.copy' or 'ansible.builtin.template' uses a variable. If this variable originates from untrusted input, it could lead to path traversal vulnerabilities, allowing files to be written outside the intended directory. Ensure all path variables are strictly validated or hardcoded.

RISK: world-readable (o+r) or world-writable (o+w) file mode set via ansible.builtin.file or copy task. Mode 0644 on a private key, 0777 on a config, or 0666 on an htpasswd is a common misconfiguration. FIX: use the least-privilege mode for the file type — private keys: 0600, config files: 0640 (owner+group read), executables: 0750. Never use 0777.