CVE-2018-12466 (published 2018-08-01T15:29Z)

openSUSE openbuildservice before 9.2.4 allowed authenticated users to delete packages on specific projects with project links.

Severity: MEDIUM
CVSS v2 base score: 5.5 (AV:N/AC:L/Au:S/C:N/I:P/A:P)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-732
cwe_name: Incorrect Permission Assignment for Critical Resource
description: The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
extended_description: When a resource is given a permission setting that provides access to a wider range of actors than required, it could lead to the exposure of sensitive information, or the modification of that resource by unintended parties. This is especially dangerous when the resource is related to program configuration, execution, or sensitive user data. For example, consider a misconfigured storage account for the cloud that can be read or written by a public or anonymous user.
         

Fix information:
repo_url: https://github.com/openSUSE/open-build-service
commit_details: repo_url: https://github.com/openSUSE/open-build-service
author: Marcus Huewe
author_date: 2018-07-05 12:48:41+02:00
msg: Ignore a project link in BsRequestAction.check_action_permission!

This makes sure that we check the permissions of the correct package. For
instance, assume that the project "Staging" is a link project where the
link points to the "Base" project. Also, assume that there exists a
"Base/foo" package, but there exists no explicit "Staging/foo" package.
Moreover, assume we check the permissions for the following "submit"
action:

<action type="submit">
  <source project="Staging" package="foo"/>
  <target project="an_arbitrary_project" package="foo"/>
</action>

In this case, the old code checks if request acceptor can modify the
"Base/foo" package (since it follows the project link). This is wrong
because the "Staging/foo" package would be turned into a branch during
accept.
The new code checks the correct package because it does not follow the
project link and requires that the source package exists in the source
project. Requiring the existence of the source package potentially
breaks artificial requests (for instance, a request where the "submit"
action from above is preceded by a "submit" action that creates a
"Staging/foo" package).

Note: so far I was unable to exploit the old code - so this is just
to avoid a potential future headache.

Fixes: commit 990ef7ccc ("[api][webui] Check access to source package")
repository: repo_url: https://github.com/openSUSE/open-build-service
repo_name: openSUSE/open-build-service
description: Build and distribute Linux packages from sources in an automatic, consistent and reproducible way #obs
repo_language: Ruby
owner: openSUSE
file_changes: filename: bs_request_action_submit.rb
change_type: ModificationType.MODIFY
diff: @@ -115,8 +115,11 @@ class BsRequestActionSubmit < BsRequestAction
     target_package = target_project.packages.find_by_name(self.target_package)
     initialize_devel_package = target_project.find_attribute('OBS', 'InitializeDevelPackage')
     return if target_package || !initialize_devel_package
-    source_package = Package.get_by_project_and_name(source_project, self.source_package)
-    return if !source_package || User.current.can_modify?(source_package)
+    opts = { follow_project_links: false }
+    source_package = Package.get_by_project_and_name!(source_project,
+                                                      self.source_package,
+                                                      opts)
+    return if User.current.can_modify?(source_package)
     msg = 'No permission to initialize the source package as a devel package'
     raise PostRequestNoPermission, msg
   end

programming_language: Ruby