CVE-2024-39900 (published 2024-07-09T22:15Z)

OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when accessing resources in a private tenant, leading to potential data being revealed. The patches are included in OpenSearch 2.14.


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/opensearch-project/reporting
commit_details: repo_url: https://github.com/opensearch-project/reporting
author: opensearch-trigger-bot[bot]
author_date: 2024-04-26 10:11:40-07:00
msg: tenancy access control (#992) (#993)

* Check user name for private tenant access control



* fix broken link



---------


(cherry picked from commit 99f02f3745d7e9a88c144b3f2cba000e153bfd07)

Signed-off-by: Sean Kao <seankao@amazon.com>
Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
repository: repo_url: https://github.com/opensearch-project/reporting
repo_name: opensearch-project/reporting
description: Export and automate PNG, PDF, and CSV reports in OpenSearch Dashboards
repo_language: Kotlin
owner: opensearch-project
file_changes: filename: README.md
change_type: ModificationType.MODIFY
diff: @@ -60,7 +60,7 @@ OpenSearch Dashboards Reports allows ‘Report Owner’ (engineers, including bu
 [reports-scheduler-it-badge]: https://img.shields.io/badge/Reports%20Scheduler%20IT%20tests-in%20progress-yellow
 [reports-scheduler-it-link]: https://github.com/opensearch-project/opensearch-build/issues/1124
 [reports-scheduler-it-code-badge]: https://img.shields.io/badge/Reports%20Scheduler%20code-blue
-[reports-scheduler-it-code-link]: https://github.com/opensearch-project/dashboards-reports/blob/main/reports-scheduler/src/test/kotlin/org/opensearch/reportsscheduler/ReportsSchedulerPluginIT.kt
+[reports-scheduler-it-code-link]: https://github.com/opensearch-project/reporting/blob/main/src/test/kotlin/org/opensearch/integTest/ReportsSchedulerPluginIT.kt
 [bwc-tests-badge]: https://img.shields.io/badge/BWC%20tests-in%20progress-yellow
 [bwc-tests-link]: https://github.com/opensearch-project/dashboards-reports/pull/244/files
 [good-first-badge]: https://img.shields.io/github/issues/opensearch-project/dashboards-reports/good%20first%20issue.svg

programming_language: Markdown
filename: UserAccessManager.kt
change_type: ModificationType.MODIFY
diff: @@ -118,6 +118,9 @@ internal object UserAccessManager {
         if (getUserTenant(user) != tenant) {
             return false
         }
+        if (isUserPrivateTenant(user)) {
+            return access.contains("$USER_TAG${user.name}")
+        }
         return if (PluginSettings.isRbacEnabled()) {
             user.backendRoles.map { "$BACKEND_ROLE_TAG$it" }.any { it in access }
         } else {

programming_language: Swift