Repository navigation
Fix sharing: enforce authorization and validate credential references in sharing and revision APIs - #888
Merged
Conversation
…tion by adding ownership checks and adding cross validation between ACL's item_guid and item_id Any authenticated user was able to create or modify a public share (ACL entry) for credentials of other users, and the ACL's item_id was never checked against its item_guid. The latter allowed resolving arbitrary credentials by their sequential id through the public share endpoint, using any owned credential guid. Signed-off-by: binsky <timo@binsky.org>
Signed-off-by: binsky <timo@binsky.org>
Signed-off-by: binsky <timo@binsky.org>
`occ passman:sharing:check-acls [--json]` lists sharing ACL entries whose item_id does not reference the credential identified by their item_guid, including the owners of both credentials. Such entries can be the result of the item id injection fixed before (passman <= 2.6.3) or leftovers of deleted credentials. Signed-off-by: binsky <timo@binsky.org>
Every legitimate share (link or user) requires the shared credential to have a shared key, which is only removed again by unsharing, which also deletes all ACLs. So ACL entries whose item_guid credential has no shared key cannot be legitimate, even if item_id and item_guid match. Signed-off-by: binsky <timo@binsky.org>
Signed-off-by: binsky <timo@binsky.org>
…heck in the corresponding acl mapper class Signed-off-by: binsky <timo@binsky.org>
Signed-off-by: binsky <timo@binsky.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes several authorization issues in the sharing and revision APIs, reported via the Nextcloud HackerOne program and extended by further findings during the analysis. Details will be published in a security advisory after the release.