The Ansible jailexec FreeBSD Jail connection plugin's put_file method, in versions before 2.0.0, resolves destination paths by concatenating the jail filesystem root with the destination path and executes mkdir -p and mv commands as root on the host. These commands follow symbolic links, allowing a symlink placed inside the jail to redirect the host-side root mv operation outside the jail. This enables an attacker controlling content inside the jail to write arbitrary files as root on the host, effectively escaping the jail confinement. The vulnerability requires the operator to run a copy/template/fetch task using put_file against the jail and the attacker to pre-place a symlink at or above the destination path inside the jail. The issue is fixed in version 2.0.0 by running file transfers inside the jail via jexec, ensuring all path resolutions remain within the jail's chroot, thus preventing host escape via symlinks.

An attacker with the ability to create symlinks inside a managed FreeBSD jail can leverage this vulnerability to cause arbitrary root-owned file writes on the host system outside the jail. This can lead to full host compromise by modifying critical files such as cron jobs, startup scripts, or authorized SSH keys. The vulnerability effectively allows a jail escape, breaking the isolation guarantees of the jail environment.

A patch is available in Ansible jailexec version 2.0.0, which fixes the vulnerability by performing file transfers inside the jail environment, preventing symlink traversal to the host. Users should upgrade to version 2.0.0 or later. There are no workarounds for affected versions prior to 2.0.0.