Project

General

Profile

Actions

Bug #16971

closed

CVE-2016-7077 - Association lists (for < 6 items) shown without authorization/filters

Added by Marek Hulán over 7 years ago. Updated over 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
Security
Target version:
Difficulty:
Triaged:
Fixed in Releases:
Found in Releases:

Description

To reproduce:

1. setup user with permissions to create architectures
2. make sure you have less than 6 OS in Foreman
3. login as that user, try to create architecture
4. you can see all OSes listed there even if the user does not have any OS
permission

Note that when there are 6 or more OSes, association is authorized properly.

The code that's responsible for this can be found at [1]. I believe it's
present since Foreman 1.1 [2]. Since this is in generic helper, each form
using this helper is vulnerable. It looks like the >= 6 code path (via multiple_select) had
authorisation implemented in #7337 for 1.9.0, and the < 6 code path was left untouched.

[1] https://github.com/theforeman/foreman/blob/develop/app/helpers/form_helper.rb#L48-L58
[2] https://github.com/theforeman/foreman/commit/14d225cc561b6fb2678eb87e9323d7750a06195c


Related issues 1 (0 open1 closed)

Related to Foreman - Bug #17256: Non-admin user can't edit his own profile if he has more than 5 rolesClosedMarek Hulán11/07/2016Actions
Actions #1

Updated by Marek Hulán over 7 years ago

  • translation missing: en.field_release set to 189
Actions #2

Updated by Dominic Cleal over 7 years ago

  • Subject changed from Associations are not authorized if resource count is less than 6 to CVE-2016-7077 - Association lists (for < 6 items) shown without authorization/filters
  • Status changed from New to Assigned
Actions #3

Updated by Marek Hulán over 7 years ago

  • Target version changed from 1.5.0 to 1.4.2
Actions #4

Updated by The Foreman Bot over 7 years ago

  • Status changed from Assigned to Ready For Testing
  • Pull request https://github.com/theforeman/foreman/pull/3955 added
Actions #5

Updated by Marek Hulán over 7 years ago

  • Related to Bug #17256: Non-admin user can't edit his own profile if he has more than 5 roles added
Actions #6

Updated by Marek Hulán over 7 years ago

  • Target version changed from 1.4.2 to 1.4.4
Actions #7

Updated by Anonymous over 7 years ago

  • Status changed from Ready For Testing to Closed
  • % Done changed from 0 to 100
Actions

Also available in: Atom PDF