CVE-2024-39901 (published 2024-07-09T22:15Z)

OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/opensearch-project/observability
commit_details: repo_url: https://github.com/opensearch-project/observability
author: opensearch-trigger-bot[bot]
author_date: 2024-04-26 10:12:18-07:00
msg: tenancy access control (#1821) (#1822)

* Check user name for private tenant access control



* fix broken link



* remove broken link



---------


(cherry picked from commit de183277b3c8782373eb520e6c4018eb55d3c119)

Signed-off-by: Sean Kao <seankao@amazon.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
repository: repo_url: https://github.com/opensearch-project/observability
repo_name: opensearch-project/observability
description: Visualize and explore your logs, traces and metrics data in OpenSearch Dashboards
repo_language: Kotlin
owner: opensearch-project
file_changes: filename: DEVELOPER_GUIDE.md
change_type: ModificationType.MODIFY
diff: @@ -14,8 +14,8 @@ By default, tests use the same runtime as `JAVA_HOME`.
 
 ### Setup
 
-1. Download OpenSearch for the version that matches the [OpenSearch Dashboards version specified in opensearch_dashboards.json](./dashboards-observability/opensearch_dashboards.json#L4) from [opensearch.org](https://opensearch.org/downloads.html).
-1. Download the OpenSearch Dashboards source code for the [version specified in opensearch_dashboards.json](./dashboards-observability/opensearch_dashboards.json#L4) you want to set up.
+1. Download OpenSearch for the version that matches the OpenSearch Dashboards version specified in `opensearch_dashboards.json` from [opensearch.org](https://opensearch.org/downloads.html).
+1. Download the OpenSearch Dashboards source code for the version specified in `opensearch_dashboards.json` you want to set up.
 1. Change your node version to the version specified in `.node-version` inside the OpenSearch Dashboards root directory.
 1. cd into `OpenSearch-Dashboards` and remove the `plugins` directory.
 1. Check out this package from version control as the `plugins` directory.

programming_language: Markdown
filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -66,11 +66,10 @@ Observability is collection of plugins and applications that let you visualize d
 [cypress-test-badge]: https://img.shields.io/badge/Cypress%20tests-in%20progress-yellow
 [cypress-test-link]: https://github.com/opensearch-project/opensearch-build/issues/1124
 [cypress-code-badge]: https://img.shields.io/badge/Cypress%20code-blue
-[cypress-code-link]: https://github.com/opensearch-project/observability/blob/main/dashboards-observability/.cypress/CYPRESS_TESTS.md
 [opensearch-it-badge]: https://img.shields.io/badge/OpenSearch%20Plugin%20IT%20tests-in%20progress-yellow
 [opensearch-it-link]: https://github.com/opensearch-project/opensearch-build/issues/1124
 [opensearch-it-code-badge]: https://img.shields.io/badge/OpenSearch%20IT%20code-blue
-[opensearch-it-code-link]: https://github.com/opensearch-project/observability/blob/main/opensearch-observability/src/test/kotlin/org/opensearch/observability/ObservabilityPluginIT.kt
+[opensearch-it-code-link]: https://github.com/opensearch-project/observability/blob/main/src/test/kotlin/org/opensearch/observability/ObservabilityPluginIT.kt
 [bwc-tests-badge]: https://img.shields.io/badge/BWC%20tests-in%20progress-yellow
 [bwc-tests-link]: https://github.com/opensearch-project/observability/issues/276
 [good-first-badge]: https://img.shields.io/github/issues/opensearch-project/observability/good%20first%20issue.svg

programming_language: Markdown
filename: UserAccessManager.kt
change_type: ModificationType.MODIFY
diff: @@ -147,6 +147,9 @@ internal object UserAccessManager {
         if (getUserTenant(user) != tenant) {
             return false
         }
+        if (isUserPrivateTenant(user)) {
+            return access.contains("$USER_TAG${user.name}")
+        }
         if (canAdminViewAllItems(user)) {
             return true
         }

programming_language: Swift