CVE-2024-39901: Insufficient Information (NVD-CWE-noinfo)
value: OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-09T22:15Z
Repository: https://github.com/opensearch-project/observability
Language: Markdown
Files changed: DEVELOPER_GUIDE.md, README.md, src/main/kotlin/org/opensearch/observability/security/UserAccessManager.kt
Commit date: 2024-04-26 10:12:18 -0700
Commit message: tenancy access control (#1821) (#1822)

* Check user name for private tenant access control



* fix broken link



* remove broken link



---------


(cherry picked from commit de183277b3c8782373eb520e6c4018eb55d3c119)

Signed-off-by: Sean Kao <seankao@amazon.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Diff: diff --git a/DEVELOPER_GUIDE.md b/DEVELOPER_GUIDE.md
index d9a2573..dc56d08 100644
--- a/DEVELOPER_GUIDE.md
+++ b/DEVELOPER_GUIDE.md
@@ -12,12 +12,12 @@ for your JDK 11 installation, e.g. `JAVA_HOME=/usr/lib/jvm/jdk-11`.
 
 By default, tests use the same runtime as `JAVA_HOME`.
 
 ### Setup
 
-1. Download OpenSearch for the version that matches the [OpenSearch Dashboards version specified in opensearch_dashboards.json](./dashboards-observability/opensearch_dashboards.json#L4) from [opensearch.org](https://opensearch.org/downloads.html).
-1. Download the OpenSearch Dashboards source code for the [version specified in opensearch_dashboards.json](./dashboards-observability/opensearch_dashboards.json#L4) you want to set up.
+1. Download OpenSearch for the version that matches the OpenSearch Dashboards version specified in `opensearch_dashboards.json` from [opensearch.org](https://opensearch.org/downloads.html).
+1. Download the OpenSearch Dashboards source code for the version specified in `opensearch_dashboards.json` you want to set up.
 1. Change your node version to the version specified in `.node-version` inside the OpenSearch Dashboards root directory.
 1. cd into `OpenSearch-Dashboards` and remove the `plugins` directory.
 1. Check out this package from version control as the `plugins` directory.
 ```bash
 git clone https://github.com/opensearch-project/observability plugins --no-checkout
diff --git a/README.md b/README.md
index ed0aa25..dd996ca 100644
--- a/README.md
+++ b/README.md
@@ -64,15 +64,14 @@ Observability is collection of plugins and applications that let you visualize d
 [opensearch-codecov-badge]: https://codecov.io/gh/opensearch-project/observability/branch/main/graphs/badge.svg?flag=opensearch-observability
 [codecov-link]: https://codecov.io/gh/opensearch-project/observability
 [cypress-test-badge]: https://img.shields.io/badge/Cypress%20tests-in%20progress-yellow
 [cypress-test-link]: https://github.com/opensearch-project/opensearch-build/issues/1124
 [cypress-code-badge]: https://img.shields.io/badge/Cypress%20code-blue
-[cypress-code-link]: https://github.com/opensearch-project/observability/blob/main/dashboards-observability/.cypress/CYPRESS_TESTS.md
 [opensearch-it-badge]: https://img.shields.io/badge/OpenSearch%20Plugin%20IT%20tests-in%20progress-yellow
 [opensearch-it-link]: https://github.com/opensearch-project/opensearch-build/issues/1124
 [opensearch-it-code-badge]: https://img.shields.io/badge/OpenSearch%20IT%20code-blue
-[opensearch-it-code-link]: https://github.com/opensearch-project/observability/blob/main/opensearch-observability/src/test/kotlin/org/opensearch/observability/ObservabilityPluginIT.kt
+[opensearch-it-code-link]: https://github.com/opensearch-project/observability/blob/main/src/test/kotlin/org/opensearch/observability/ObservabilityPluginIT.kt
 [bwc-tests-badge]: https://img.shields.io/badge/BWC%20tests-in%20progress-yellow
 [bwc-tests-link]: https://github.com/opensearch-project/observability/issues/276
 [good-first-badge]: https://img.shields.io/github/issues/opensearch-project/observability/good%20first%20issue.svg
 [good-first-link]: https://github.com/opensearch-project/observability/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22+
 [feature-badge]: https://img.shields.io/github/issues/opensearch-project/observability/feature.svg
diff --git a/src/main/kotlin/org/opensearch/observability/security/UserAccessManager.kt b/src/main/kotlin/org/opensearch/observability/security/UserAccessManager.kt
index 4437053..bd5b038 100644
--- a/src/main/kotlin/org/opensearch/observability/security/UserAccessManager.kt
+++ b/src/main/kotlin/org/opensearch/observability/security/UserAccessManager.kt
@@ -145,10 +145,13 @@ internal object UserAccessManager {
             return true
         }
         if (getUserTenant(user) != tenant) {
             return false
         }
+        if (isUserPrivateTenant(user)) {
+            return access.contains("$USER_TAG${user.name}")
+        }
         if (canAdminViewAllItems(user)) {
             return true
         }
         return when (PluginSettings.filterBy) {
             FilterBy.NoFilter -> true

Vulnerable code: 1. Download OpenSearch for the version that matches the [OpenSearch Dashboards version specified in opensearch_dashboards.json](./dashboards-observability/opensearch_dashboards.json#L4) from [opensearch.org](https://opensearch.org/downloads.html).
1. Download the OpenSearch Dashboards source code for the [version specified in opensearch_dashboards.json](./dashboards-observability/opensearch_dashboards.json#L4) you want to set up.
[cypress-code-link]: https://github.com/opensearch-project/observability/blob/main/dashboards-observability/.cypress/CYPRESS_TESTS.md
[opensearch-it-code-link]: https://github.com/opensearch-project/observability/blob/main/opensearch-observability/src/test/kotlin/org/opensearch/observability/ObservabilityPluginIT.kt
Fixed code: 1. Download OpenSearch for the version that matches the OpenSearch Dashboards version specified in `opensearch_dashboards.json` from [opensearch.org](https://opensearch.org/downloads.html).
1. Download the OpenSearch Dashboards source code for the version specified in `opensearch_dashboards.json` you want to set up.
[opensearch-it-code-link]: https://github.com/opensearch-project/observability/blob/main/src/test/kotlin/org/opensearch/observability/ObservabilityPluginIT.kt
        if (isUserPrivateTenant(user)) {
            return access.contains("$USER_TAG${user.name}")
        }