CVE-2018-7688 (published 2018-06-07T13:29Z)

A missing permission check in the review handling of openSUSE Open Build Service before 2.9.3 allowed all authenticated users to modify sources in projects where they do not have write permissions.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/openSUSE/open-build-service
commit_details: repo_url: https://github.com/openSUSE/open-build-service
author: Marcus Huewe
author_date: 2018-05-27 12:35:05+02:00
msg: [api] Initialize review state with :new

to have the request review always in a sane state.

https://bugzilla.suse.com/show_bug.cgi?id=1094820

Signed-off-by: Christian Bruckmayer <cbruckmayer@suse.com>
Co-authored-by: Christian Bruckmayer <cbruckmayer@suse.com>
repository: repo_url: https://github.com/openSUSE/open-build-service
repo_name: openSUSE/open-build-service
description: Build and distribute Linux packages from sources in an automatic, consistent and reproducible way #obs
repo_language: Ruby
owner: openSUSE
file_changes: filename: review.rb
change_type: ModificationType.MODIFY
diff: @@ -133,8 +133,8 @@ class Review < ApplicationRecord
   def self.new_from_xml_hash(hash)
     r = Review.new
 
-    r.state = hash.delete('state') { raise ArgumentError, 'no state' }
-    r.state = r.state.to_sym
+    r.state = :new
+    hash.delete('state')
 
     r.by_user = hash.delete('by_user')
     r.by_group = hash.delete('by_group')

programming_language: Ruby
filename: review_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -427,4 +427,20 @@ RSpec.describe Review do
       expect(review_by_package.reviewable_by?(by_package: other_package.name)).to be_falsy
     end
   end
+
+  describe '.new_from_xml_hash' do
+    let(:request_xml) do
+      "<request>
+        <review state='accepted' by_user='#{user}'/>
+      </request>"
+    end
+    let(:request_hash) { Xmlhash.parse(request_xml) }
+    let(:review_hash) { request_hash['review'] }
+
+    subject { Review.new_from_xml_hash(review_hash) }
+
+    it 'initalizes the review in state :new' do
+      expect(subject.state).to eq(:new)
+    end
+  end
 end

programming_language: Ruby
filename: bs_request_test.rb
change_type: ModificationType.MODIFY
diff: @@ -125,7 +125,32 @@ class BsRequestTest < ActiveSupport::TestCase
     assert_equal 1027, req.number
 
     newxml = req.render_xml
-    assert_equal xml, newxml
+    expected = <<-XML.strip_heredoc
+      <request id="1027" creator="Iggy">
+        <action type="submit">
+          <source project="home:Iggy" package="TestPack" rev="1"/>
+          <target project="kde4" package="mypackage"/>
+          <options>
+            <sourceupdate>cleanup</sourceupdate>
+          </options>
+          <acceptinfo rev="1" srcmd5="806a6e27ed7915d1bb8d8a989404fd5a" osrcmd5="d41d8cd98f00b204e9800998ecf8427e"/>
+        </action>
+        <priority>critical</priority>
+        <state name="review" who="Iggy" when="2012-11-07T21:13:12">
+          <comment>No comment</comment>
+        </state>
+        <review state="new" when="2017-09-01T09:11:11" by_user="adrian"/>
+        <review state="new" when="2017-09-01T09:11:11" by_group="test_group"/>
+        <review state="new" when="2012-11-07T21:13:12" who="tom" by_user="tom">
+          <comment>review1</comment>
+        </review>
+        <review state="new" when="2012-11-07T21:13:13" who="tom" by_user="tom">
+          <comment>please accept</comment>
+        </review>
+        <description>Left blank</description>
+      </request>
+    XML
+    assert_equal expected, newxml
 
     wi = req.webui_infos(diffs: false)
     # iggy is *not* target maintainer

programming_language: Ruby