CVE-2021-41189 (Java, published 2021-10-29T18:15Z)
Description: value: DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a workaround, users of 7.0 may temporarily disable the ability for community or collection administrators to manage permissions or workflows settings.
Severity: HIGH (CVSS v3 base score: 7.2)
Weakness: CWE-863 \u2014 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
Repository: https://github.com/DSpace/DSpace
Files changed:
dspace-api/src/main/java/org/dspace/content/CollectionServiceImpl.java
dspace-api/src/main/java/org/dspace/content/service/CollectionService.java
dspace-api/src/main/java/org/dspace/eperson/GroupServiceImpl.java
Commit message: Fix for GHSA-cf2j-vf36-c6w8


Vulnerable code:
        groupService.setName(role, "COLLECTION_" + collection.getID().toString() + "_" + typeOfGroupString +
            "_DEFAULT_READ");
                            if (policies.size() > 0) {
                                return policies.get(0).getdSpaceObject();
                            if (policies.size() > 0) {
                                return policies.get(0).getdSpaceObject();

Fixed code:
        groupService.setName(role, getDefaultReadGroupName(collection, typeOfGroupString));
    @Override
    public String getDefaultReadGroupName(Collection collection, String typeOfGroupString) {
        return "COLLECTION_" + collection.getID().toString() + "_" + typeOfGroupString +
            "_DEFAULT_READ";
    }

    /**
     * This method will return the name to give to the group created by the
     * {@link #createDefaultReadGroup(Context, Collection, String, int)} method
     * 
     * @param collection        The DSpace collection to use in the name generation
     * @param typeOfGroupString The type of group to use in the name generation
     * @return the name to give to the group that hold default read for the collection
     */
    String getDefaultReadGroupName(Collection collection, String typeOfGroupString);

import java.util.Optional;

                            Optional<ResourcePolicy> defaultPolicy = policies.stream().filter(p -> StringUtils.equals(
                                    collectionService.getDefaultReadGroupName((Collection) p.getdSpaceObject(), "ITEM"),
                                    group.getName())).findFirst();

                            if (defaultPolicy.isPresent()) {
                                return defaultPolicy.get().getdSpaceObject();

                            defaultPolicy = policies.stream()
                                    .filter(p -> StringUtils.equals(collectionService.getDefaultReadGroupName(
                                            (Collection) p.getdSpaceObject(), "BITSTREAM"), group.getName()))
                                    .findFirst();

                            if (defaultPolicy.isPresent()) {
                                return defaultPolicy.get().getdSpaceObject();