CVE-2018-7689 (Ruby, published 2018-06-07T13:29Z)
Description: value: Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-862 \u2014 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Repository: https://github.com/openSUSE/open-build-service
Files changed:
src/api/app/models/bs_request_action_submit.rb
src/api/test/functional/request_controller_test.rb
Commit message: [api][webui] Check access to source package

to make sure user can write to it.

https://bugzilla.suse.com/show_bug.cgi?id=1094819

Signed-off-by: Christian Bruckmayer <cbruckmayer@suse.com>
Co-authored-by: Christian Bruckmayer <cbruckmayer@suse.com>


Vulnerable code:

Fixed code:
  def check_action_permission!(skip_source = nil)
    super(skip_source)
    # only perform the following check, if we are called from
    # BsRequest.permission_check_change_state! (that is, if
    # skip_source is set to true). Always executing this check
    # would be a regression, because this code is also executed
    # if a new request is created (which could fail if User.current
    # cannot modify the source_package).
    return unless skip_source
    target_project = Project.get_by_name(self.target_project)
    return unless target_project && target_project.is_a?(Project)
    target_package = target_project.packages.find_by_name(self.target_package)
    initialize_devel_package = target_project.find_attribute('OBS', 'InitializeDevelPackage')
    return if target_package || !initialize_devel_package
    source_package = Package.get_by_project_and_name(source_project, self.source_package)
    return if !source_package || User.current.can_modify_package?(source_package)
    msg = 'No permission to initialize the source package as a devel package'
    raise PostRequestNoPermission, msg
  end

    # Accept will fail because Fred does not have permissions on the source package
    # which is required because of the InitializeDevelPackage attribute on kde4
    login_fred
    post "/request/#{id}?cmd=changestate&newstate=accepted"
    assert_response 403
    assert_match(/No permission to initialize the source package as a devel package/, @response.body)

    # We need to set permissions on the source because of the InitializeDevelPackage attribute on kde4 project
    login_king
    put '/source/home:Iggy:branches:kde4/_meta', params: "<project name='home:Iggy:branches:kde4'><title/><description/><person userid='fred' role='maintainer'/></project>"
    assert_response :success

    # Accept will fail because adrian does not have permissions on the source
    # which is required because of the InitializeDevelPackage attribute on kde4
    post "/request/#{id}?cmd=changestate&newstate=accepted&force=1"
    assert_response 403
    assert_match(/No permission to initialize the source package as a devel package/, @response.body)

    # Adding adrian as maintainoer of the source
    login_Iggy
    get '/source/home:Iggy/_meta'
    iggy_meta = @response.body
    put '/source/home:Iggy/_meta', params: "<project name='home:Iggy'><title/><description/><person userid='adrian' role='maintainer'/></project>"

    assert_response :success

    login_adrian
    login_Iggy
    put '/source/home:Iggy/_meta', params: iggy_meta