CVE-2020-29158 (published 2020-12-28T08:15Z)

An issue was discovered in Zammad before 3.5.1. An Agent with Customer permissions in a Group can bypass intended access control on internal Articles via the Ticket detail view.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/zammad/zammad
commit_details: repo_url: https://github.com/zammad/zammad
author: Rolf Schmidt
author_date: 2020-10-29 15:43:14+01:00
msg: Maintenance: Improved article view for agent customer.
repository: repo_url: https://github.com/zammad/zammad
repo_name: zammad/zammad
description: Zammad is a web based open source helpdesk/customer support system
repo_language: Ruby
owner: zammad
file_changes: filename: article_policy.rb
change_type: ModificationType.MODIFY
diff: @@ -55,9 +55,9 @@ class Ticket::ArticlePolicy < ApplicationPolicy
   end
 
   def access?(query)
-    return false if record.internal == true && !user.permissions?('ticket.agent')
-
     ticket = Ticket.lookup(id: record.ticket_id)
+    return false if record.internal == true && !TicketPolicy.new(user, ticket).agent_read_access?
+
     Pundit.authorize(user, ticket, query)
   end
 end

programming_language: Ruby
filename: ticket_policy.rb
change_type: ModificationType.MODIFY
diff: @@ -41,6 +41,10 @@ class TicketPolicy < ApplicationPolicy
     raise Exceptions::UnprocessableEntity, 'Cannot follow-up on a closed ticket. Please create a new ticket.'
   end
 
+  def agent_read_access?
+    agent_access?('read')
+  end
+
   private
 
   def access?(access)

programming_language: Ruby
filename: role.rb
change_type: ModificationType.MODIFY
diff: @@ -8,6 +8,10 @@ FactoryBot.define do
       permissions { Permission.where(name: 'ticket.agent') }
     end
 
+    trait :customer do
+      permissions { Permission.where(name: 'ticket.customer') }
+    end
+
     trait :admin do
       permissions { Permission.where(name: 'admin') }
     end

programming_language: Ruby
filename: article_policy_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -29,6 +29,15 @@ describe Ticket::ArticlePolicy do
       it { is_expected.to permit_actions(%i[show]) }
     end
 
+    context 'when agent and customer but no agent group access' do
+      let(:user) do
+        customer_role = create(:role, :customer)
+        create(:agent_and_customer, roles: [customer_role])
+      end
+
+      it { is_expected.not_to permit_actions(%i[show]) }
+    end
+
     context 'when customer' do
       let(:user) { ticket_customer }
 

programming_language: Ruby