A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components, such as the controller, hub, and eda.
Use HTTPS on the platform ingress if possible.
Since this is a problem in edge-terminated AAP deployments where requests have TLS terminated right before the platform ingress, enforce trusted origins before requests reach the gateway.
A tool such as a Web-application firewall should be able to manage this issue.
Exploits
Credits
This issue was discovered by Brennan Paciorek (Red Hat Inc.), Chris Meyers (Red Hat Inc.), Hao Liu (Red Hat Inc.), and Julen Landa Alustiza (Red Hat Inc.).