CVE-2018-12467: Incorrect Permission Assignment for Critical Resource (CWE-732)
value: Authorized users of the openbuildservice before 2.9.4 could delete packages by using a malicious request against projects having the OBS:InitializeDevelPackage attribute, a similar issue to CVE-2018-7689.
CWE description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CVSS v3 base score: 6.5
Published: 2018-08-01T15:29Z
Repository: https://github.com/openSUSE/open-build-service
Language: Ruby
Files changed: src/api/app/models/bs_request_action_submit.rb
Commit date: 2018-07-24 09:42:22 +0200
Commit message: Ignore a project link in BsRequestAction.check_action_permission!

This makes sure that we check the permissions of the correct package. For
instance, assume that the project "Staging" is a link project where the
link points to the "Base" project. Also, assume that there exists a
"Base/foo" package, but there exists no explicit "Staging/foo" package.
Moreover, assume we check the permissions for the following "submit"
action:

<action type="submit">
  <source project="Staging" package="foo"/>
  <target project="an_arbitrary_project" package="foo"/>
</action>

In this case, the old code checks if request acceptor can modify the
"Base/foo" package (since it follows the project link). This is wrong
because the "Staging/foo" package would be turned into a branch during
accept.
The new code checks the correct package because it does not follow the
project link and requires that the source package exists in the source
project. Requiring the existence of the source package potentially
breaks artificial requests (for instance, a request where the "submit"
action from above is preceded by a "submit" action that creates a
"Staging/foo" package).

Note: so far I was unable to exploit the old code - so this is just
to avoid a potential future headache.

Fixes: commit 990ef7ccc ("[api][webui] Check access to source package")

Diff: diff --git a/src/api/app/models/bs_request_action_submit.rb b/src/api/app/models/bs_request_action_submit.rb
index 7e4f39db1a..a08110ef40 100644
--- a/src/api/app/models/bs_request_action_submit.rb
+++ b/src/api/app/models/bs_request_action_submit.rb
@@ -113,12 +113,15 @@ class BsRequestActionSubmit < BsRequestAction
     target_project = Project.get_by_name(self.target_project)
     return unless target_project && target_project.is_a?(Project)
     target_package = target_project.packages.find_by_name(self.target_package)
     initialize_devel_package = target_project.find_attribute('OBS', 'InitializeDevelPackage')
     return if target_package || !initialize_devel_package
-    source_package = Package.get_by_project_and_name(source_project, self.source_package)
-    return if !source_package || User.current.can_modify?(source_package)
+    opts = { follow_project_links: false }
+    source_package = Package.get_by_project_and_name!(source_project,
+                                                      self.source_package,
+                                                      opts)
+    return if User.current.can_modify?(source_package)
     msg = 'No permission to initialize the source package as a devel package'
     raise PostRequestNoPermission, msg
   end
 
   #### Alias of methods

Vulnerable code:     source_package = Package.get_by_project_and_name(source_project, self.source_package)
    return if !source_package || User.current.can_modify?(source_package)
Fixed code:     opts = { follow_project_links: false }
    source_package = Package.get_by_project_and_name!(source_project,
                                                      self.source_package,
                                                      opts)
    return if User.current.can_modify?(source_package)