CVE-2020-10194 (published 2020-03-20T21:15Z)

cs/service/account/AutoCompleteGal.java in Zimbra zm-mailbox before 8.8.15.p8 allows authenticated users to request any GAL account. This differs from the intended behavior in which the domain of the authenticated user must match the domain of the galsync account in the request.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/Zimbra/zm-mailbox
commit_details: repo_url: https://github.com/Zimbra/zm-mailbox
author: sneha-patil-synacor
author_date: 2020-02-12 16:08:01+05:30
msg: ZBUG-1094:Broken GAL search filtering
repository: repo_url: https://github.com/Zimbra/zm-mailbox
repo_name: Zimbra/zm-mailbox
description: zm-mailbox for Zimbra Collaboration Suite, FOSS Edition
repo_language: Java
owner: Zimbra
file_changes: filename: AutoCompleteGal.java
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 /*
  * ***** BEGIN LICENSE BLOCK *****
  * Zimbra Collaboration Suite Server
- * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2013, 2014, 2016 Synacor, Inc.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011, 2013, 2014, 2016, 2020 Synacor, Inc.
  *
  * This program is free software: you can redistribute it and/or modify it under
  * the terms of the GNU General Public License as published by the Free Software Foundation,
@@ -57,8 +57,14 @@ public class AutoCompleteGal extends GalDocumentHandler {
         params.setLimit(account.getContactAutoCompleteMaxResults());
         params.setNeedCanExpand(needCanExpand);
         params.setResponseName(AccountConstants.AUTO_COMPLETE_GAL_RESPONSE);
-        if (galAcctId != null)
-            params.setGalSyncAccount(Provisioning.getInstance().getAccountById(galAcctId));
+        if (galAcctId != null) {
+            Account galAccount = Provisioning.getInstance().getAccountById(galAcctId);
+            if (galAccount != null && (!account.getDomainId().equals(galAccount.getDomainId()))) {
+                throw ServiceException
+                    .PERM_DENIED("can not access galsync account of different domain");
+            }
+            params.setGalSyncAccount(galAccount);
+        }
         GalSearchControl gal = new GalSearchControl(params);
         gal.autocomplete();
         return params.getResultCallback().getResponse();

programming_language: Java