Project

General

Profile

Actions

Bug #30739

closed

CVE-2020-14380: Users can gain elevated rights when logging in with SSO accounts

Added by Tomer Brisker about 4 years ago. Updated about 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
Security
Target version:
Difficulty:
Triaged:
No
Fixed in Releases:
Found in Releases:

Description

Cloned from https://bugzilla.redhat.com/show_bug.cgi?id=1873439
Description of problem:
User that are authenticated via keycload/RH SSO can claim the rights
of already existing local users

Version-Release number of selected component (if applicable):
6.7.2+

How reproducible:
Everytime

Steps to Reproduce:
1. Create user sectest (local on Satellite) with Sat admin rights and password redhat (Authorized by: INTERNAL)
2. Create user sectest (on RH SSO) with different password
3. Login to Satellite with the SSO user

Actual results:
The user sectest from SSO has full admin rights on the Satellite

Expected results:
Local users on Satellite with authorization source INTERNAL should not be able to login via SSO

Additional info:

Scenario:

- local admin user exists, example "admin" 
- SSO admin creates user with the same name in SSO
- The SSO admin user can login to Satellite and has admin rights
- this is even worse as the users in SSO may be fedarated from other ldap or ADS sources
and the Satellite admins have no idea the same users exist in other directories'
Actions

Also available in: Atom PDF