CVE-2011-4183 (published 2018-06-13T13:29Z)

A vulnerability in open build service allows remote attackers to upload arbitrary RPM files. Affected releases are SUSE open build service prior to 2.1.16.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-434
cwe_name: Unrestricted Upload of File with Dangerous Type
description: The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
extended_description: 
            
            
            
            
            
         
         

Fix information:
repo_url: https://github.com/openSUSE/open-build-service
commit_details: repo_url: https://github.com/openSUSE/open-build-service
author: Adrian Schröter
author_date: 2011-12-12 15:46:52+01:00
msg: [api] support binary package upload for the admin
repository: repo_url: https://github.com/openSUSE/open-build-service
repo_name: openSUSE/open-build-service
description: Build and distribute Linux packages from sources in an automatic, consistent and reproducible way #obs
repo_language: Ruby
owner: openSUSE
file_changes: filename: build_controller.rb
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 class BuildController < ApplicationController
 
   def index
-    valid_http_methods :get, :post, :put
+    valid_http_methods :get, :post
 
     # for permission check
     if params[:package] and not ["_repository", "_jobhistory"].include?(params[:package])
@@ -10,7 +10,19 @@ class BuildController < ApplicationController
       prj = DbProject.get_by_name params[:project]
     end
 
-    pass_to_backend 
+    if request.get?
+      pass_to_backend 
+      return
+    end
+
+    if @http_user.is_admin?
+      # check for a local package instance
+      DbPackage.get_by_project_and_name( params[:project], params[:package], follow_project_links=false )
+      pass_to_backend
+    else
+      render_error :status => 403, :errorcode => "execute_cmd_no_permission",
+        :message => "Upload of binaries is only permitted for administrators"
+    end
   end
 
   def project_index
@@ -128,21 +140,6 @@ class BuildController < ApplicationController
     pass_to_backend
   end
 
-  # /build/:prj/:repo/:arch/:pkg
-  def package_index
-    valid_http_methods :get
-    required_parameters :project, :repository, :arch, :package
-
-    # read access permission check
-    if params[:package] == "_repository"
-      prj = DbProject.get_by_name params[:project], use_source=false
-    else
-      pkg = DbPackage.get_by_project_and_name params[:project], params[:package], use_source=false
-    end
-
-    pass_to_backend
-  end
-
   # /build/:project/:repository/:arch/:package/:filename
   def file
     valid_http_methods :get, :delete

programming_language: Ruby
filename: build_controller_test.rb
change_type: ModificationType.MODIFY
diff: @@ -39,6 +39,32 @@ class BuildControllerTest < ActionController::IntegrationTest
     assert_response 404
   end
 
+  def test_upload_binaries
+    ActionController::IntegrationTest::reset_auth
+    post "/build/home:Iggy/10.2/i586/TestPack", nil
+    assert_response 401
+
+    prepare_request_with_user "adrian", "so_alone"
+    post "/build/home:Iggy/10.2/i586/TestPack", nil
+    assert_response 403
+
+    prepare_request_with_user "king", "sunflower"
+    post "/build/home:Iggy/10.2/i586/TestPack", nil
+    assert_response 400 # actually a success, it reached the backend
+    assert_tag :tag => "status", :attributes => { :code => "400", :origin => "backend" }
+
+    # check not supported methods
+    post "/build/home:Iggy/10.2/i586/_repository", nil
+    assert_response 404
+    assert_tag :tag => "status", :attributes => { :code => "unknown_package" }
+    put "/build/home:Iggy/10.2/i586/TestPack", nil
+    assert_response 400
+    assert_tag :tag => "status", :attributes => { :code => "invalid_http_method" }
+    delete "/build/home:Iggy/10.2/i586/TestPack"
+    assert_response 400
+    assert_tag :tag => "status", :attributes => { :code => "invalid_http_method" }
+  end
+
   def test_dispatchprios
     ActionController::IntegrationTest::reset_auth
     get "/build/_dispatchprios"

programming_language: Ruby