CVE-2013-3703 (Ruby, published 2018-06-08T17:29Z)
Description: value: The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-275 \u2014 Permission Issues
Weaknesses in this category are related to improper assignment or handling of permissions.
Repository: https://github.com/openSUSE/open-build-service
Files changed:
src/api/app/controllers/application_controller.rb
src/api/app/models/package.rb
src/api/app/models/project.rb
src/api/test/unit/project_test.rb
Commit message: [api] move write permission checks from controller to package and project model

This is just the first part doing the checks. Removing the old ones is another step.


Vulnerable code:
    # set user if nil, needed for delayed job in Package model
    User.current ||= User.find_by_login(params[:user])


Fixed code:
  rescue_from Project::WritePermissionError do |exception|
    render_error :status => 403, :errorcode => "modify_project_no_permission", :message => exception.message
  end

  rescue_from Package::WritePermissionError do |exception|
    render_error :status => 403, :errorcode => "modify_package_no_permission", :message => exception.message
  end

  class WritePermissionError < APIException
    setup "package_write_permission_error"
  end
  def check_write_access!
    return if Rails.env.test? and User.current.nil? # for unit tests

    unless User.current.can_modify_package? self
      raise WritePermissionError, "No permission to modify package '#{self.name}' for user '#{User.current.login}'"
    end
  end

    check_write_access!
    check_write_access!
    check_write_access!
    check_write_access!
    # no write access check here, since this operation may will disable this permission ...
    check_write_access!
    check_write_access!
    check_write_access!
    check_write_access!
    check_write_access!
    check_write_access!
  class WritePermissionError < APIException
    setup "project_write_permission_error"
  end
  def check_write_access!
    return if Rails.env.test? and User.current.nil? # for unit tests

    # the can_create_check is inconsistent with package class check_write_access! check
    unless User.current.can_modify_project?(self) || User.current.can_create_project?(self.name)
      raise WritePermissionError, "No permission to modify project '#{self.name}' for user '#{User.current.login}'"
    end
  end

    check_write_access!

    check_write_access!

    check_write_access!

    check_write_access!

    check_write_access!

    # set user if nil, needed for delayed job in Package model
    User.current ||= User.find_by_login(params[:user])

    check_write_access!

    check_write_access!

    check_write_access!

    check_write_access!

    check_write_access!

    check_write_access!

    check_write_access!
    User.current = users( :Iggy )
    User.current = users( :Iggy )

    User.current = users( :Iggy )

    User.current = users( :Iggy )

     User.current = users( :king )
     User.current = users( :Iggy )
     User.current = users( :Iggy )
    User.current = users( :king )