Ramon de C Valle <rcvalle> reports:
There is a improper privilege management vulnerability in the
update_roles method of the UsersController controller. The update_roles
method updates the roles of an specified user without checking the
privileges for the user performing the action.
254 def update_roles
255 params[:user] = { "role_ids" => [] } unless params.has_key? :user
256
257 #Add in the own role if updating roles, cause the user shouldn't see his own r ole
258 params[:user][:role_ids] << @user.own_role.id
259
260 if @user.update_attributes(params[:user])
261 notify.success _("User updated successfully.")
262
263 if not search_validate(User, @user.id, params[:search], :username)
264 notify.message _("'%s' no longer matches the current search criteria.") % @user.username
265 end
266
267 render :nothing => true and return
268 end
269 notify.invalid_record @user
270 render :text => @user.errors, :status => :ok
271 end
Any user can arbitrarily update any attributes of any user (including
itself) by sending a specially-crafted POST request.
Ramon de C Valle <rcvalle> reports: There is a improper privilege management vulnerability in the update_roles method of the UsersController controller. The update_roles method updates the roles of an specified user without checking the privileges for the user performing the action. 254 def update_roles 255 params[:user] = { "role_ids" => [] } unless params.has_key? :user 256 257 #Add in the own role if updating roles, cause the user shouldn't see his own r ole 258 params[:user][:role_ids] << @user.own_role.id 259 260 if @user.update_attributes(params[:user]) 261 notify.success _("User updated successfully.") 262 263 if not search_validate(User, @user.id, params[:search], :username) 264 notify.message _("'%s' no longer matches the current search criteria.") % @user.username 265 end 266 267 render :nothing => true and return 268 end 269 notify.invalid_record @user 270 render :text => @user.errors, :status => :ok 271 end Any user can arbitrarily update any attributes of any user (including itself) by sending a specially-crafted POST request.