CVE-2024-39900: Insufficient Information (NVD-CWE-noinfo)
value: OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-07-09T22:15Z
Repository: https://github.com/opensearch-project/reporting
Language: Kotlin
Files changed: README.md, src/main/kotlin/org/opensearch/reportsscheduler/security/UserAccessManager.kt
Commit date: 2024-04-26 10:11:40 -0700
Commit message: tenancy access control (#992) (#993)

* Check user name for private tenant access control



* fix broken link



---------


(cherry picked from commit 99f02f3745d7e9a88c144b3f2cba000e153bfd07)

Signed-off-by: Sean Kao <seankao@amazon.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Diff: diff --git a/README.md b/README.md
index 2354c0b..099317f 100644
--- a/README.md
+++ b/README.md
@@ -58,11 +58,11 @@ OpenSearch Dashboards Reports allows ‘Report Owner’ (engineers, including bu
 [cypress-code-badge]: https://img.shields.io/badge/Cypress%20code-blue
 [cypress-code-link]: https://github.com/opensearch-project/dashboards-reports/tree/main/dashboards-reports/.cypress/integration
 [reports-scheduler-it-badge]: https://img.shields.io/badge/Reports%20Scheduler%20IT%20tests-in%20progress-yellow
 [reports-scheduler-it-link]: https://github.com/opensearch-project/opensearch-build/issues/1124
 [reports-scheduler-it-code-badge]: https://img.shields.io/badge/Reports%20Scheduler%20code-blue
-[reports-scheduler-it-code-link]: https://github.com/opensearch-project/dashboards-reports/blob/main/reports-scheduler/src/test/kotlin/org/opensearch/reportsscheduler/ReportsSchedulerPluginIT.kt
+[reports-scheduler-it-code-link]: https://github.com/opensearch-project/reporting/blob/main/src/test/kotlin/org/opensearch/integTest/ReportsSchedulerPluginIT.kt
 [bwc-tests-badge]: https://img.shields.io/badge/BWC%20tests-in%20progress-yellow
 [bwc-tests-link]: https://github.com/opensearch-project/dashboards-reports/pull/244/files
 [good-first-badge]: https://img.shields.io/github/issues/opensearch-project/dashboards-reports/good%20first%20issue.svg
 [good-first-link]: https://github.com/opensearch-project/dashboards-reports/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22+
 [feature-badge]: https://img.shields.io/github/issues/opensearch-project/dashboards-reports/feature%20request.svg
diff --git a/src/main/kotlin/org/opensearch/reportsscheduler/security/UserAccessManager.kt b/src/main/kotlin/org/opensearch/reportsscheduler/security/UserAccessManager.kt
index 9f25831..c2f2453 100644
--- a/src/main/kotlin/org/opensearch/reportsscheduler/security/UserAccessManager.kt
+++ b/src/main/kotlin/org/opensearch/reportsscheduler/security/UserAccessManager.kt
@@ -116,10 +116,13 @@ internal object UserAccessManager {
             return true
         }
         if (getUserTenant(user) != tenant) {
             return false
         }
+        if (isUserPrivateTenant(user)) {
+            return access.contains("$USER_TAG${user.name}")
+        }
         return if (PluginSettings.isRbacEnabled()) {
             user.backendRoles.map { "$BACKEND_ROLE_TAG$it" }.any { it in access }
         } else {
             true
         }

Vulnerable code: [reports-scheduler-it-code-link]: https://github.com/opensearch-project/dashboards-reports/blob/main/reports-scheduler/src/test/kotlin/org/opensearch/reportsscheduler/ReportsSchedulerPluginIT.kt
Fixed code: [reports-scheduler-it-code-link]: https://github.com/opensearch-project/reporting/blob/main/src/test/kotlin/org/opensearch/integTest/ReportsSchedulerPluginIT.kt
        if (isUserPrivateTenant(user)) {
            return access.contains("$USER_TAG${user.name}")
        }