Bug 829421 - (CVE-2012-2680) CVE-2012-2680 cumin: authentication bypass flaws
CVE-2012-2680 cumin: authentication bypass flaws
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20120919,repor...
: Security
Depends On: 840110 858868
Blocks: 808230 828434 828935
  Show dependency treegraph
 
Reported: 2012-06-06 12:53 EDT by Vincent Danen
Modified: 2014-06-25 17:13 EDT (History)
7 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 840110 (view as bug list)
Environment:
Last Closed: 2014-06-25 17:13:56 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2012-06-06 12:53:25 EDT
Florian Weimer reported multiple instances of unprotected access (web pages, export functionality, image viewing) in cumin.  An unauthenticated user could view pages that should have been restricted to authenticated users only, resulting in information disclosure.
Comment 1 Trevor McKay 2012-06-07 12:48:50 EDT
Fixed in revision 5398 on trunk.

Essentially, a fragment from the existing authentication check on the index.html page has been added to all widgets.  The check can be enabled or disabled, and is disabled by default.  For widgets in the page hierarchy, the check is enabled except where necessary for actual login -- the login page itself, and the css and resource pages which allow it to draw.  

Here is the diff from the commit email for reference:

Modified: trunk/cumin/python/cumin/account/widgets.py
===================================================================
--- trunk/cumin/python/cumin/account/widgets.py 2012-06-01 15:51:07 UTC (rev 5397)
+++ trunk/cumin/python/cumin/account/widgets.py 2012-06-01 21:16:27 UTC (rev 5398)
@@ -76,6 +76,10 @@
         form = LoginForm(app, "form")
         self.add_child(form)
 
+        # Make sure that we don't force a user to 
+        # be logged in when visiting the login page!
+        self.check_login = False
+
     def do_process(self, session):
         if self.logout.get(session):
             try:

Modified: trunk/wooly/python/wooly/__init__.py
===================================================================
--- trunk/wooly/python/wooly/__init__.py        2012-06-01 15:51:07 UTC (rev 5397)
+++ trunk/wooly/python/wooly/__init__.py        2012-06-01 21:16:27 UTC (rev 5398)
@@ -114,6 +114,7 @@
         self.update_enabled = False
         self.defer_enabled = False
         self.comments_enabled = True
+        self.check_login = False
 
         # These are computed later in the init pass
         self.ancestors = None
@@ -292,7 +293,23 @@
         # when a user is not authorized for this widget.
         pass
 
+    def authorized(self, session):
+        login = session.client_session.attributes.get("login_session")
+        if login:
+            when = datetime.now() - timedelta(hours=24)
+            if login.created > when:
+                return True
+        return False
+
     def process(self, session, *args):
+        if self.check_login and not self.authorized(session):
+            # redirect to the login page
+            page = self.app.login_page
+            sess = Session(page)
+            page.origin.set(sess, session.marshal())
+            self.redirect.set(session, sess.marshal())
+            return
+
         if not self.app.authorize_cb(session, self):
             self.redirect_on_not_authorized(session)
         else:
@@ -424,6 +441,10 @@
         self.profile = self.ProfileAttribute(app, "profile")
         self.add_attribute(self.profile)
 
+        # All pages should only be processed if the user
+        # is logged in, except for the login page, resource, and css.
+        self.check_login = True
+
     def init_computed_values(self):
         self.ancestors = ()
         self.path = ""

Modified: trunk/wooly/python/wooly/pages.py
===================================================================
--- trunk/wooly/python/wooly/pages.py   2012-06-01 15:51:07 UTC (rev 5397)
+++ trunk/wooly/python/wooly/pages.py   2012-06-01 21:16:27 UTC (rev 5398)
@@ -335,6 +335,7 @@
         self.html_page = html_page
         self.__then = datetime.utcnow()
         self.__css = None
+        self.check_login = False
 
     def get_last_modified(self, session):
         return self.__then
@@ -430,6 +431,7 @@
         self.add_parameter(self.rname)
 
         self.then = datetime.utcnow()
+        self.check_login = False
 
     def get_last_modified(self, session):
         return self.then
Comment 2 Tomas Hoger 2012-08-07 07:45:08 EDT
svn diff -c 5398 http://svn.fedorahosted.org/svn/cumin
Comment 6 Vincent Danen 2012-09-19 12:11:26 EDT
Acknowledgements:

These issues were discovered by Florian Weimer of the Red Hat Product Security Team.
Comment 7 errata-xmlrpc 2012-09-19 13:43:41 EDT
This issue has been addressed in following products:

  MRG for RHEL-5 v. 2

Via RHSA-2012:1278 https://rhn.redhat.com/errata/RHSA-2012-1278.html
Comment 8 errata-xmlrpc 2012-09-19 13:52:48 EDT
This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2012:1281 https://rhn.redhat.com/errata/RHSA-2012-1281.html
Comment 9 Vincent Danen 2012-09-19 17:09:27 EDT
Created cumin tracking bugs for this issue

Affects: fedora-all [bug 858868]

Note You need to log in before you can comment on or make changes to this bug.