Medium [CVE-2025-5988] Aap-gateway: csrf origin checking is disabled

A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda.

This issue is classified as Moderate because the exploitation conditions significantly limit its practicality and impact in typical deployments.

Successful exploitation requires the attacker to first obtain a valid CSRF form token tied to the victim’s session, which is generally protected by browser same-origin policies and modern CSRF mitigations—making token theft non-trivial without an existing compromise or major misconfiguration.

Additionally, the gateway is still performing Referer checks when TLS edge termination is in place, which, while not as strict as Origin validation, reduces exposure in many real-world setups.

The need for a valid authenticated session and precise token alignment means the attacker cannot simply trick a user into visiting a malicious site and execute arbitrary state-changing requests; they must overcome multiple layered controls. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N).

Weakness: CWE-352. Affected Red Hat products: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9.

Red Hat fixing advisory: RHSA-2025:12772.