Bug 1067623 (CVE-2014-0087) - CVE-2014-0087 CFME: check_privileges logic error resulting in privilege escalation
Summary: CVE-2014-0087 CFME: check_privileges logic error resulting in privilege escal...
Alias: CVE-2014-0087
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Whiteboard: impact=important,public=20150204,repo...
Keywords: Security
Depends On: 1067631 1067632
Blocks: 1067677
TreeView+ depends on / blocked
Reported: 2014-02-20 18:36 UTC by Kurt Seifried
Modified: 2019-06-08 19:55 UTC (History)
14 users (show)

Clone Of:
Last Closed: 2015-02-19 00:58:35 UTC

Attachments (Terms of Use)

Description Kurt Seifried 2014-02-20 18:36:13 UTC
Jan Rusnacko of the Red Hat Product Security Team reports:

CFME contains an authorization bypass issue in the action rbac_user_edit,
which allows authenticated users with minimal privileges to gain access to 
additional privileges.

The problem is in the method check_privileges in vmdb/app/controllers/application_controller.rb:

  def check_generic_rbac
    ident = "#{controller_name}_#{action_name}"

    if MiqProductFeature.feature_exists?(ident)
      passed = role_allows(:feature => ident, :any => true)
      unless passed
        if request.xml_http_request?
          render :update do |page|
            page.redirect_to :controller => 'dashboard', :action => 'auth_error'
          redirect_to(:controller => 'dashboard', :action => 'auth_error')
      validate_route(controller_name, request.env['REQUEST_METHOD'], action_name)

Since there is no else branch for the "if MiqProductFeature.feature_exists?(ident)", any feature that is missing from the list of known features, will be allowed by default. One of 
these such features is ops_rbac_user_edit.

This is the same exact place in code that is causing CVE-2014-0078, however, the
fix for this issue solves only CVE-2014-0078, not the problem itself. After the 
fix is applied, privileges for x_button are checked, but other actions like 
rbac_user_edit are allowed by default.

Comment 1 Kurt Seifried 2014-02-20 18:52:30 UTC

This issue was discovered by Jan Rusnacko of the Red Hat Product Security Team.

Comment 13 Martin Povolny 2015-02-05 08:33:45 UTC
I have created a hardening ticket for this here: https://github.com/ManageIQ/manageiq/issues/1581

Because this has become a hardening issue rather than a security bug.

Comment 24 Kurt Seifried 2015-02-19 00:58:20 UTC
This issue has been addressed in the following products:

  CloudForms Management Engine 5.3

Via RHSA-2015:0028 https://rhn.redhat.com/errata/RHSA-2015-0028.html

Note You need to log in before you can comment on or make changes to this bug.