Jan Rusnacko of the Red Hat Product Security Team reports:
CFME contains an authorization bypass issue in the action rbac_user_edit,
which allows authenticated users with minimal privileges to gain access to
additional privileges.
The problem is in the method check_privileges in vmdb/app/controllers/application_controller.rb:
def check_generic_rbac
ident = "#{controller_name}_#{action_name}"
if MiqProductFeature.feature_exists?(ident)
passed = role_allows(:feature => ident, :any => true)
unless passed
if request.xml_http_request?
render :update do |page|
page.redirect_to :controller => 'dashboard', :action => 'auth_error'
end
else
redirect_to(:controller => 'dashboard', :action => 'auth_error')
end
end
passed
else
validate_route(controller_name, request.env['REQUEST_METHOD'], action_name)
end
end
Since there is no else branch for the "if MiqProductFeature.feature_exists?(ident)", any feature that is missing from the list of known features, will be allowed by default. One of
these such features is ops_rbac_user_edit.
This is the same exact place in code that is causing CVE-2014-0078, however, the
fix for this issue solves only CVE-2014-0078, not the problem itself. After the
fix is applied, privileges for x_button are checked, but other actions like
rbac_user_edit are allowed by default.
Jan Rusnacko of the Red Hat Product Security Team reports: CFME contains an authorization bypass issue in the action rbac_user_edit, which allows authenticated users with minimal privileges to gain access to additional privileges. The problem is in the method check_privileges in vmdb/app/controllers/application_controller.rb: def check_generic_rbac ident = "#{controller_name}_#{action_name}" if MiqProductFeature.feature_exists?(ident) passed = role_allows(:feature => ident, :any => true) unless passed if request.xml_http_request? render :update do |page| page.redirect_to :controller => 'dashboard', :action => 'auth_error' end else redirect_to(:controller => 'dashboard', :action => 'auth_error') end end passed else validate_route(controller_name, request.env['REQUEST_METHOD'], action_name) end end Since there is no else branch for the "if MiqProductFeature.feature_exists?(ident)", any feature that is missing from the list of known features, will be allowed by default. One of these such features is ops_rbac_user_edit. This is the same exact place in code that is causing CVE-2014-0078, however, the fix for this issue solves only CVE-2014-0078, not the problem itself. After the fix is applied, privileges for x_button are checked, but other actions like rbac_user_edit are allowed by default.