CVE-2022-29237: Improper Authentication (CWE-287)
value: Opencast is a free and open source solution for automated video capture and distribution at scale. Prior to Opencast 10.14 and 11.7, users could pass along URLs for files belonging to organizations other than the user's own, which Opencast would then import into the current organization, bypassing organizational barriers. Attackers must have full access to Opencast's ingest REST interface, and also know internal links to resources in another organization of the same Opencast cluster. Users who do not run a multi-tenant cluster are not affected by this issue. This issue is fixed in Opencast 10.14 and 11.7.
CWE description: When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CVSS v3 base score: 5.4
Published: 2022-05-24T15:15Z
Repository: https://github.com/opencast/opencast
Language: Java
Files changed: modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java
Commit date: 2022-05-18 12:43:56 +0200
Commit message: Merge pull request from GHSA-qm6v-cg9v-53j3

This patch fixes the issue that users can pass URLs from other tenants
to the ingest service which will check only against the other
organization but not against the one currently active. This allows users
to easily ingest media from other tenants.
Diff: diff --git a/modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java b/modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java
index f50e7cbefec..f12f2eaeea4 100644
--- a/modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java
+++ b/modules/ingest-service-impl/src/main/java/org/opencastproject/ingest/impl/IngestServiceImpl.java
@@ -127,19 +127,17 @@ import java.nio.charset.StandardCharsets;
 import java.util.Arrays;
 import java.util.Date;
 import java.util.Dictionary;
 import java.util.HashMap;
 import java.util.HashSet;
-import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
 import java.util.Map.Entry;
 import java.util.Objects;
 import java.util.Set;
 import java.util.UUID;
 import java.util.concurrent.TimeUnit;
-import java.util.stream.Collectors;
 
 import javax.management.ObjectInstance;
 
 /**
  * Creates and augments Opencast MediaPackages. Stores media into the Working File Repository.
@@ -1566,20 +1564,11 @@ public class IngestServiceImpl extends AbstractJobProducer implements IngestServ
     HttpResponse response = null;
     CloseableHttpClient externalHttpClient = null;
     try {
       if (uri.toString().startsWith("http")) {
         HttpGet get = new HttpGet(uri);
-        List<String> clusterUrls = new LinkedList<>();
-        try {
-          // Note that we are not checking ports here.
-          clusterUrls = organizationDirectoryService.getOrganization(uri.toURL()).getServers()
-                          .keySet()
-                          .stream()
-                          .collect(Collectors.toUnmodifiableList());
-        } catch (NotFoundException e) {
-          logger.warn("Unable to determine cluster members, will not be able to authenticate any downloads from them", e);
-        }
+        var clusterUrls = securityService.getOrganization().getServers().keySet();
 
         if (uri.toString().matches(downloadSource)) {
           //NB: We're creating a new client here with *different* auth than the system auth creds
           externalHttpClient = getAuthedHttpClient();
           response = externalHttpClient.execute(get);

Vulnerable code: import java.util.LinkedList;
import java.util.stream.Collectors;
        List<String> clusterUrls = new LinkedList<>();
        try {
          // Note that we are not checking ports here.
          clusterUrls = organizationDirectoryService.getOrganization(uri.toURL()).getServers()
                          .keySet()
                          .stream()
                          .collect(Collectors.toUnmodifiableList());
        } catch (NotFoundException e) {
          logger.warn("Unable to determine cluster members, will not be able to authenticate any downloads from them", e);
        }
Fixed code:         var clusterUrls = securityService.getOrganization().getServers().keySet();