CVE-2014-8540 (published 2018-01-05T16:29Z)

The groups API in GitLab 6.x and 7.x before 7.4.3 allows remote authenticated guest users to modify ownership of arbitrary groups by leveraging improper permission checks.

Severity: MEDIUM
CVSS v2 base score: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
CVSS v3 base score: 6.5, MEDIUM (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://gitlab.com/gitlab-org/gitlab-ce
commit_details: repo_url: https://gitlab.com/gitlab-org/gitlab-ce
author: Dmitriy Zaporozhets
author_date: 2014-10-29 13:38:00+02:00
msg: Dont allow guests..developers to manage group members

Signed-off-by: Dmitriy Zaporozhets <dmitriy.zaporozhets@gmail.com>
repository: repo_url: https://gitlab.com/gitlab-org/gitlab-ce
repo_name: visit repo url
description: visit repo url
repo_language: visit repo url
owner: gitlab-org
file_changes: filename: group_members.rb
change_type: ModificationType.MODIFY
diff: @@ -39,14 +39,18 @@ def validate_access_level?(level)
       # Example Request:
       #  POST /groups/:id/members
       post ":id/members" do
+        group = find_group(params[:id])
+        authorize! :manage_group, group
         required_attributes! [:user_id, :access_level]
+
         unless validate_access_level?(params[:access_level])
           render_api_error!("Wrong access level", 422)
         end
-        group = find_group(params[:id])
+
         if group.group_members.find_by(user_id: params[:user_id])
           render_api_error!("Already exists", 409)
         end
+
         group.add_users([params[:user_id]], params[:access_level])
         member = group.group_members.find_by(user_id: params[:user_id])
         present member.user, with: Entities::GroupMember, group: group
@@ -62,7 +66,9 @@ def validate_access_level?(level)
       #   DELETE /groups/:id/members/:user_id
       delete ":id/members/:user_id" do
         group = find_group(params[:id])
-        member =  group.group_members.find_by(user_id: params[:user_id])
+        authorize! :manage_group, group
+        member = group.group_members.find_by(user_id: params[:user_id])
+
         if member.nil?
           render_api_error!("404 Not Found - user_id:#{params[:user_id]} not a member of group #{group.name}",404)
         else

programming_language: Ruby
filename: group_members_spec.rb
change_type: ModificationType.MODIFY
diff: @@ -115,16 +115,22 @@
 
     context "when a member of the group" do
       it "should delete guest's membership of group" do
-        count_before=group_with_members.group_members.count
-        delete api("/groups/#{group_with_members.id}/members/#{guest.id}", owner)
+        expect {
+          delete api("/groups/#{group_with_members.id}/members/#{guest.id}", owner)
+        }.to change { group_with_members.members.count }.by(-1)
+
         response.status.should == 200
-        group_with_members.group_members.count.should == count_before - 1
       end
 
       it "should return a 404 error when user id is not known" do
         delete api("/groups/#{group_with_members.id}/members/1328", owner)
         response.status.should == 404
       end
+
+      it "should not allow guest to modify group members" do
+        delete api("/groups/#{group_with_members.id}/members/#{master.id}", guest)
+        response.status.should == 403
+      end
     end
   end
 end

programming_language: Ruby