Project

General

Profile

Bug #16971

CVE-2016-7077 - Association lists (for < 6 items) shown without authorization/filters

Added by Marek Hulán over 6 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
Security
Target version:
Difficulty:
Triaged:
Bugzilla link:
Fixed in Releases:
Found in Releases:
Red Hat JIRA:

Description

To reproduce:

1. setup user with permissions to create architectures
2. make sure you have less than 6 OS in Foreman
3. login as that user, try to create architecture
4. you can see all OSes listed there even if the user does not have any OS
permission

Note that when there are 6 or more OSes, association is authorized properly.

The code that's responsible for this can be found at [1]. I believe it's
present since Foreman 1.1 [2]. Since this is in generic helper, each form
using this helper is vulnerable. It looks like the >= 6 code path (via multiple_select) had
authorisation implemented in #7337 for 1.9.0, and the < 6 code path was left untouched.

[1] https://github.com/theforeman/foreman/blob/develop/app/helpers/form_helper.rb#L48-L58
[2] https://github.com/theforeman/foreman/commit/14d225cc561b6fb2678eb87e9323d7750a06195c


Related issues

Related to Foreman - Bug #17256: Non-admin user can't edit his own profile if he has more than 5 rolesClosed2016-11-07

Associated revisions

Revision caffb7e8 (diff)
Added by Marek Hulán over 6 years ago

Fixes #16971 - CVE-2016-7077 remove unauthorized checkboxes

History

#1 Updated by Marek Hulán over 6 years ago

  • Legacy Backlogs Release (now unused) set to 189

#2 Updated by Dominic Cleal over 6 years ago

  • Subject changed from Associations are not authorized if resource count is less than 6 to CVE-2016-7077 - Association lists (for < 6 items) shown without authorization/filters
  • Status changed from New to Assigned

#3 Updated by Marek Hulán over 6 years ago

  • Target version changed from 1.5.0 to 1.4.2

#4 Updated by The Foreman Bot over 6 years ago

  • Status changed from Assigned to Ready For Testing
  • Pull request https://github.com/theforeman/foreman/pull/3955 added

#5 Updated by Marek Hulán over 6 years ago

  • Related to Bug #17256: Non-admin user can't edit his own profile if he has more than 5 roles added

#6 Updated by Marek Hulán over 6 years ago

  • Target version changed from 1.4.2 to 1.4.4

#7 Updated by Anonymous over 6 years ago

  • Status changed from Ready For Testing to Closed
  • % Done changed from 0 to 100

Also available in: Atom PDF