CVE-2011-5097 (published 2012-08-08T10:26Z)

chef-server-api/app/controllers/cookbooks.rb in Chef Server in Chef before 0.9.18, and 0.10.x before 0.10.2, does not require administrative privileges for the update and destroy methods, which allows remote authenticated users to (1) upload cookbooks via a knife cookbook upload command or (2) delete cookbooks via a knife cookbook delete command.

Severity: MEDIUM
CVSS v2 base score: 5.5 (AV:N/AC:L/Au:S/C:N/I:P/A:P)

Weakness information:
cwe_id: CWE-264
cwe_name: Permissions, Privileges, and Access Controls
description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Fix information:
repo_url: https://github.com/opscode/chef
commit_details: repo_url: https://github.com/opscode/chef
author: Noah Kantrowitz
author_date: 2011-06-28 20:13:10-07:00
msg: Do not allow non-admins to upload or delete cookbooks.
repository: repo_url: https://github.com/opscode/chef
repo_name: chef/chef
description: Chef Infra, a powerful automation platform that transforms infrastructure into code automating how infrastructure is configured, deployed and managed across any environment, at any scale
repo_language: Ruby
owner: opscode
file_changes: filename: cookbooks.rb
change_type: ModificationType.MODIFY
diff: @@ -30,6 +30,7 @@ class Cookbooks < Application
 
   before :authenticate_every
   before :params_helper
+  before :is_admin, :only => [ :update, :destroy ]
 
   attr_accessor :cookbook_name, :cookbook_version
 

programming_language: Ruby
filename: delete_cookbooks.feature
change_type: ModificationType.MODIFY
diff: @@ -52,3 +52,10 @@ Feature: CRUD cookbooks
      When I 'DELETE' to the path '/cookbooks/testcookbook_nonexistent/1.2.3'
      Then I should get a '404 "Not Found"' exception
 
+  @delete_cookbook_negative @cookbook_non_admin
+  Scenario: I should not be able to delete cookbook if I am not an admin
+    Given I am an administrator
+     When I fully upload a sandboxed cookbook named 'testcookbook_valid' versioned '0.1.0' with 'testcookbook_valid'
+    Given I am a non-admin
+     When I 'DELETE' to the path '/cookbooks/testcookbook_valid/0.1.0'
+     Then I should get a '403 "Forbidden"' exception

programming_language: Ruby
filename: upload_cookbooks.feature
change_type: ModificationType.MODIFY
diff: @@ -155,3 +155,22 @@ Feature: CRUD cookbooks
       And I have uploaded a frozen cookbook named 'testcookbook_valid' at version '0.1.0'
      When I upload a cookbook named 'testcookbook_valid' at version '0.1.0'
      Then I should get a '409 "Conflict"' exception
+
+  @create_cookbook_negative @cookbook_non_admin
+  Scenario: Should not be able to create a cookbook if I am not an admin
+    Given I am an administrator
+     When I create a sandbox named 'sandbox1' for cookbook 'testcookbook_valid'
+     Then the inflated responses key 'uri' should match '^http://.+/sandboxes/[^\/]+$'
+     Then I upload a file named 'metadata.json' from cookbook 'testcookbook_valid' to the sandbox
+     Then the response code should be '200'
+     Then I upload a file named 'metadata.rb' from cookbook 'testcookbook_valid' to the sandbox
+     Then the response code should be '200'
+     Then I upload a file named 'attributes/attributes.rb' from cookbook 'testcookbook_valid' to the sandbox
+     Then the response code should be '200'
+     Then I upload a file named 'recipes/default.rb' from cookbook 'testcookbook_valid' to the sandbox
+     Then the response code should be '200'
+     When I commit the sandbox
+     Then I should not get an exception
+    Given I am a non-admin
+     When I create a versioned cookbook named 'testcookbook_valid' versioned '0.1.0' with 'testcookbook_valid'
+     Then I should get a '403 "Forbidden"' exception

programming_language: Ruby
filename: env.rb
change_type: ModificationType.MODIFY
diff: @@ -135,8 +135,11 @@ def create_databases
   Chef::Environment.create_default_environment
   system("cp #{File.join(Dir.tmpdir, "chef_integration", "validation.pem")} #{Dir.tmpdir}")
   system("cp #{File.join(Dir.tmpdir, "chef_integration", "webui.pem")} #{Dir.tmpdir}")
+  c = Chef::ApiClient.cdb_load(Chef::Config[:web_ui_client_name])
+  c.admin(true)
+  c.cdb_save
 
-  cmd = [KNIFE_CMD, "cookbook", "upload", "-a", "-o", INTEGRATION_COOKBOOKS, "-u", "validator", "-k", File.join(Dir.tmpdir, "validation.pem"), "-c", KNIFE_CONFIG]
+  cmd = [KNIFE_CMD, "cookbook", "upload", "-a", "-o", INTEGRATION_COOKBOOKS, "-u", Chef::Config[:web_ui_client_name], "-k", File.join(Dir.tmpdir, "webui.pem"), "-c", KNIFE_CONFIG]
   Chef::Log.info("Uploading fixture cookbooks with #{cmd.join(' ')}")
   cmd << {:timeout => 120}
   shell_out!(*cmd)

programming_language: Ruby