Bug #16971
closedCVE-2016-7077 - Association lists (for < 6 items) shown without authorization/filters
Description
To reproduce:
1. setup user with permissions to create architectures
2. make sure you have less than 6 OS in Foreman
3. login as that user, try to create architecture
4. you can see all OSes listed there even if the user does not have any OS
permission
Note that when there are 6 or more OSes, association is authorized properly.
The code that's responsible for this can be found at [1]. I believe it's
present since Foreman 1.1 [2]. Since this is in generic helper, each form
using this helper is vulnerable. It looks like the >= 6 code path (via multiple_select) had
authorisation implemented in #7337 for 1.9.0, and the < 6 code path was left untouched.
[1] https://github.com/theforeman/foreman/blob/develop/app/helpers/form_helper.rb#L48-L58
[2] https://github.com/theforeman/foreman/commit/14d225cc561b6fb2678eb87e9323d7750a06195c
Updated by Marek Hulán almost 8 years ago
- Translation missing: en.field_release set to 189
Updated by Dominic Cleal almost 8 years ago
- Subject changed from Associations are not authorized if resource count is less than 6 to CVE-2016-7077 - Association lists (for < 6 items) shown without authorization/filters
- Status changed from New to Assigned
Updated by Marek Hulán almost 8 years ago
- Target version changed from 1.5.0 to 1.4.2
Updated by The Foreman Bot almost 8 years ago
- Status changed from Assigned to Ready For Testing
- Pull request https://github.com/theforeman/foreman/pull/3955 added
Updated by Marek Hulán almost 8 years ago
- Related to Bug #17256: Non-admin user can't edit his own profile if he has more than 5 roles added
Updated by Marek Hulán almost 8 years ago
- Target version changed from 1.4.2 to 1.4.4
Updated by Anonymous almost 8 years ago
- Status changed from Ready For Testing to Closed
- % Done changed from 0 to 100
Applied in changeset caffb7e8a60004c9c536d594ff767be33046f372.