CVE-2018-7689 (published 2018-06-07T13:29Z)

Lack of permission checks in the InitializeDevelPackage function in openSUSE Open Build Service before 2.9.3 allowed authenticated users to modify packages where they do not have write permissions.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/openSUSE/open-build-service
commit_details: repo_url: https://github.com/openSUSE/open-build-service
author: Marcus Huewe
author_date: 2018-05-26 19:18:29+02:00
msg: [api][webui] Check access to source package

to make sure user can write to it.

https://bugzilla.suse.com/show_bug.cgi?id=1094819

Signed-off-by: Christian Bruckmayer <cbruckmayer@suse.com>
Co-authored-by: Christian Bruckmayer <cbruckmayer@suse.com>
repository: repo_url: https://github.com/openSUSE/open-build-service
repo_name: openSUSE/open-build-service
description: Build and distribute Linux packages from sources in an automatic, consistent and reproducible way #obs
repo_language: Ruby
owner: openSUSE
file_changes: filename: bs_request_action_submit.rb
change_type: ModificationType.MODIFY
diff: @@ -98,6 +98,26 @@ class BsRequestActionSubmit < BsRequestAction
     Project.find_by_name!(self.target_project).update_product_autopackages
   end
 
+  def check_action_permission!(skip_source = nil)
+    super(skip_source)
+    # only perform the following check, if we are called from
+    # BsRequest.permission_check_change_state! (that is, if
+    # skip_source is set to true). Always executing this check
+    # would be a regression, because this code is also executed
+    # if a new request is created (which could fail if User.current
+    # cannot modify the source_package).
+    return unless skip_source
+    target_project = Project.get_by_name(self.target_project)
+    return unless target_project && target_project.is_a?(Project)
+    target_package = target_project.packages.find_by_name(self.target_package)
+    initialize_devel_package = target_project.find_attribute('OBS', 'InitializeDevelPackage')
+    return if target_package || !initialize_devel_package
+    source_package = Package.get_by_project_and_name(source_project, self.source_package)
+    return if !source_package || User.current.can_modify_package?(source_package)
+    msg = 'No permission to initialize the source package as a devel package'
+    raise PostRequestNoPermission, msg
+  end
+
   #### Alias of methods
 end
 

programming_language: Ruby
filename: request_controller_test.rb
change_type: ModificationType.MODIFY
diff: @@ -2038,6 +2038,18 @@ class RequestControllerTest < ActionDispatch::IntegrationTest
     assert_no_xml_tag(tag: 'person', attributes: { userid: 'Iggy', role: 'maintainer' })
     assert_no_xml_tag(tag: 'group', attributes: { groupid: 'test_group', role: 'reader' })
 
+    # Accept will fail because Fred does not have permissions on the source package
+    # which is required because of the InitializeDevelPackage attribute on kde4
+    login_fred
+    post "/request/#{id}?cmd=changestate&newstate=accepted"
+    assert_response 403
+    assert_match(/No permission to initialize the source package as a devel package/, @response.body)
+
+    # We need to set permissions on the source because of the InitializeDevelPackage attribute on kde4 project
+    login_king
+    put '/source/home:Iggy:branches:kde4/_meta', params: "<project name='home:Iggy:branches:kde4'><title/><description/><person userid='fred' role='maintainer'/></project>"
+    assert_response :success
+
     # Successful accept the request
     login_fred
     post "/request/#{id}?cmd=changestate&newstate=accepted"
@@ -2142,6 +2154,21 @@ class RequestControllerTest < ActionDispatch::IntegrationTest
     assert_xml_tag(tag: 'state', attributes: { name: 'review' },
                    parent: { tag: 'request' }) # switch to new after last review
 
+    # Accept will fail because adrian does not have permissions on the source
+    # which is required because of the InitializeDevelPackage attribute on kde4
+    post "/request/#{id}?cmd=changestate&newstate=accepted&force=1"
+    assert_response 403
+    assert_match(/No permission to initialize the source package as a devel package/, @response.body)
+
+    # Adding adrian as maintainoer of the source
+    login_Iggy
+    get '/source/home:Iggy/_meta'
+    iggy_meta = @response.body
+    put '/source/home:Iggy/_meta', params: "<project name='home:Iggy'><title/><description/><person userid='adrian' role='maintainer'/></project>"
+
+    assert_response :success
+
+    login_adrian
     # approve accepted and check initialized devel package
     post "/request/#{id}?cmd=changestate&newstate=accepted&force=1"
     assert_response :success
@@ -2155,6 +2182,8 @@ class RequestControllerTest < ActionDispatch::IntegrationTest
     assert_response :success
     delete '/source/kde4/Testing'
     assert_response :success
+    login_Iggy
+    put '/source/home:Iggy/_meta', params: iggy_meta
   end
 
   def test_reviewer_added_when_source_maintainer_is_missing

programming_language: Ruby