CVE-2021-41189 (published 2021-10-29T18:15Z)

DSpace is an open source turnkey repository application. In version 7.0, any community or collection administrator can escalate their permission up to become system administrator. This vulnerability only exists in 7.0 and does not impact 6.x or below. This issue is patched in version 7.1. As a workaround, users of 7.0 may temporarily disable the ability for community or collection administrators to manage permissions or workflows settings.

Severity: HIGH
CVSS v2 base score: 9.0 (AV:N/AC:L/Au:S/C:C/I:C/A:C)
CVSS v3 base score: 7.2, HIGH (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/DSpace/DSpace
commit_details: repo_url: https://github.com/DSpace/DSpace
author: Tim Donohue
author_date: 2021-10-26 11:31:42-05:00
msg: Merge pull request from GHSA-cf2j-vf36-c6w8

Default groups issue
repository: repo_url: https://github.com/DSpace/DSpace
repo_name: DSpace/DSpace
description: (Official) The DSpace digital asset management system that powers your Institutional Repository
repo_language: Java
owner: DSpace
repo_url: https://github.com/DSpace/DSpace
commit_details: repo_url: https://github.com/DSpace/DSpace
author: Andrea Bollini
author_date: 2021-10-25 19:01:36+02:00
msg: Fix for GHSA-cf2j-vf36-c6w8
repository: repo_url: https://github.com/DSpace/DSpace
repo_name: DSpace/DSpace
description: (Official) The DSpace digital asset management system that powers your Institutional Repository
repo_language: Java
owner: DSpace
file_changes: filename: CollectionServiceImpl.java
change_type: ModificationType.MODIFY
diff: @@ -920,8 +920,7 @@ public class CollectionServiceImpl extends DSpaceObjectServiceImpl<Collection> i
                                         int defaultRead)
         throws SQLException, AuthorizeException {
         Group role = groupService.create(context);
-        groupService.setName(role, "COLLECTION_" + collection.getID().toString() + "_" + typeOfGroupString +
-            "_DEFAULT_READ");
+        groupService.setName(role, getDefaultReadGroupName(collection, typeOfGroupString));
 
         // Remove existing privileges from the anonymous group.
         authorizeService.removePoliciesActionFilter(context, collection, defaultRead);
@@ -932,6 +931,12 @@ public class CollectionServiceImpl extends DSpaceObjectServiceImpl<Collection> i
         return role;
     }
 
+    @Override
+    public String getDefaultReadGroupName(Collection collection, String typeOfGroupString) {
+        return "COLLECTION_" + collection.getID().toString() + "_" + typeOfGroupString +
+            "_DEFAULT_READ";
+    }
+
     @Override
     public List<Collection> findCollectionsWithSubmit(String q, Context context, Community community,
         int offset, int limit) throws SQLException, SearchServiceException {

programming_language: Java
filename: CollectionService.java
change_type: ModificationType.MODIFY
diff: @@ -360,6 +360,16 @@ public interface CollectionService
     Group createDefaultReadGroup(Context context, Collection collection, String typeOfGroupString, int defaultRead)
         throws SQLException, AuthorizeException;
 
+    /**
+     * This method will return the name to give to the group created by the
+     * {@link #createDefaultReadGroup(Context, Collection, String, int)} method
+     * 
+     * @param collection        The DSpace collection to use in the name generation
+     * @param typeOfGroupString The type of group to use in the name generation
+     * @return the name to give to the group that hold default read for the collection
+     */
+    String getDefaultReadGroupName(Collection collection, String typeOfGroupString);
+
     /**
      * Returns Collections for which the current user has 'submit' privileges.
      * NOTE: for better performance, this method retrieves its results from an

programming_language: Java
filename: GroupServiceImpl.java
change_type: ModificationType.MODIFY
diff: @@ -15,6 +15,7 @@ import java.util.Iterator;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
+import java.util.Optional;
 import java.util.Set;
 import java.util.UUID;
 
@@ -735,13 +736,24 @@ public class GroupServiceImpl extends DSpaceObjectServiceImpl<Group> implements
                             groups.add(group);
                             List<ResourcePolicy> policies = resourcePolicyService.find(context, null, groups,
                                                             Constants.DEFAULT_ITEM_READ, Constants.COLLECTION);
-                            if (policies.size() > 0) {
-                                return policies.get(0).getdSpaceObject();
+
+                            Optional<ResourcePolicy> defaultPolicy = policies.stream().filter(p -> StringUtils.equals(
+                                    collectionService.getDefaultReadGroupName((Collection) p.getdSpaceObject(), "ITEM"),
+                                    group.getName())).findFirst();
+
+                            if (defaultPolicy.isPresent()) {
+                                return defaultPolicy.get().getdSpaceObject();
                             }
                             policies = resourcePolicyService.find(context, null, groups,
                                                              Constants.DEFAULT_BITSTREAM_READ, Constants.COLLECTION);
-                            if (policies.size() > 0) {
-                                return policies.get(0).getdSpaceObject();
+
+                            defaultPolicy = policies.stream()
+                                    .filter(p -> StringUtils.equals(collectionService.getDefaultReadGroupName(
+                                            (Collection) p.getdSpaceObject(), "BITSTREAM"), group.getName()))
+                                    .findFirst();
+
+                            if (defaultPolicy.isPresent()) {
+                                return defaultPolicy.get().getdSpaceObject();
                             }
                         }
                     }

programming_language: Java