CVE-2021-43781 (published 2021-12-06T18:15Z)

Invenio-Drafts-Resources is a submission/deposit module for Invenio, a software framework for research data management. Invenio-Drafts-Resources prior to versions 0.13.7 and 0.14.6 does not properly check permissions when a record is published. The vulnerability is exploitable in a default installation of InvenioRDM. An authenticated a user is able via REST API calls to publish draft records of other users if they know the record identifier and the draft validates (e.g. all require fields filled out). An attacker is not able to modify the data in the record, and thus e.g. *cannot* change a record from restricted to public. The problem is patched in Invenio-Drafts-Resources v0.13.7 and 0.14.6, which is part of InvenioRDM v6.0.1 and InvenioRDM v7.0 respectively.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:P/I:N/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: CWE-863
cwe_name: Incorrect Authorization
description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are incorrectly applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/inveniosoftware/invenio-drafts-resources
commit_details: repo_url: https://github.com/inveniosoftware/invenio-drafts-resources
author: Lars Holm Nielsen
author_date: 2021-11-24 15:32:41+01:00
msg: security: fix missing permission check of publish

* Invenio-Drafts-Resources does not properly check permissions when a
  record is published. The vulnerability is exploitable in a default
  installation of InvenioRDM. An authenticated a user is able via REST
  API calls to publish draft records of other users if they know the
  record identifier and the draft validates (e.g. all require fields
  filled out). An attacker is not able to modify the data in the record,
  and thus e.g. cannot change a record from restricted to public.
repository: repo_url: https://github.com/inveniosoftware/invenio-drafts-resources
repo_name: inveniosoftware/invenio-drafts-resources
description: Submission/deposit module for Invenio
repo_language: Python
owner: inveniosoftware
file_changes: filename: service.py
change_type: ModificationType.MODIFY
diff: @@ -267,10 +267,9 @@ class RecordService(RecordServiceBase):
               into records)
             - Create or update associated (published) record with data
         """
-        self.require_permission(identity, "publish")
-
         # Get the draft
         draft = self.draft_cls.pid.resolve(id_, registered_only=False)
+        self.require_permission(identity, "publish", record=draft)
 
         # Validate the draft strictly - since a draft can be saved with errors
         # we do a strict validation here to make sure only valid drafts can be

programming_language: Python