Uploaded image for project: 'Infinispan'
  1. Infinispan
  2. ISPN-14986

CVE-2023-3629 Non-admins should not be able to get cache config via REST API

This issue belongs to an archived project. You can view it, but you can't modify it. Learn more

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Major Major
    • 14.0.18.Final, 15.0.0.Final
    • 11.0.15.Final, 12.1.12.Final, 14.0.11.Final, 13.0.17.Final, 15.0.0.Final
    • REST, Security
    • None

      The REST endpoint to retrieve cache configurations doesn't check for ADMIN permissions:

      GET /rest/v2/caches/{cacheName}?action=config
GET /rest/v2/caches

      The cache configuration may contain information about filesystem paths and allowed security roles which should not be viewable by non-administrators.

      The first method should return a 403 in case the user doesn't have appropriate permissions.
      The second method should omit the full cache configuration from the response (it returns other, non-security sensitive information).

      The methods require authentication, but once authenticated, any user can invoke them successfully.

            [ISPN-14986] CVE-2023-3629 Non-admins should not be able to get cache config via REST API

            Tristan Tarrant created issue -
            Tristan Tarrant made changes -
            Link New: This issue is caused by ISPN-11525 [ ISPN-11525 ]
            Tristan Tarrant made changes -
            Affects Version/s New: 13.0.17.Final [ 12409032 ]
            Affects Version/s New: 12.1.12.Final [ 12379804 ]
            Affects Version/s New: 11.0.15.Final [ 12379353 ]
            Tristan Tarrant made changes -
            Security Original: Red Hat Internal [ 10291 ] New: Security Issue [ 10292 ]
            Tristan Tarrant made changes -
            Description Original: The REST endpoint to retrieve cache configurations doesn't check for ADMIN permissions:
            /rest/v2/caches/{cacheName}?action=config
            		New: The REST endpoint to retrieve cache configurations doesn't check for ADMIN permissions:

            {{
            GET /rest/v2/caches/{cacheName}?action=config
            GET /rest/v2/caches
            }}


            Tristan Tarrant made changes -
            Description Original: The REST endpoint to retrieve cache configurations doesn't check for ADMIN permissions:

            {{
            GET /rest/v2/caches/{cacheName}?action=config
            GET /rest/v2/caches
            }}


            		New: The REST endpoint to retrieve cache configurations doesn't check for ADMIN permissions:

            {noformat}
            GET /rest/v2/caches/{cacheName}?action=config
            GET /rest/v2/caches
            {noformat}

            The cache configuration may contain information about filesystem paths and allowed security roles which should not be viewable by non-administrators.

            The first method should return a 403 in case the user doesn't have appropriate permissions.
            The second method should omit the full cache configuration from the response (it returns other, non-security sensitive information).

            The methods require authentication, but once authenticated, any user can invoke them successfully.
            Wolf Fink made changes -
            Link New: This issue causes DGSUP-222 [ DGSUP-222 ]
            Tristan Tarrant made changes -
            Link New: This issue blocks JDG-6367 [ JDG-6367 ]
            Tristan Tarrant made changes -
            Status Original: New [ 10016 ] New: Open [ 1 ]
            Tristan Tarrant made changes -
            Git Pull Request New: https://github.com/infinispan/infinispan/pull/11319
            Status Original: Open [ 1 ] New: Pull Request Sent [ 10011 ]
            Tristan Tarrant made changes -
            Security Original: Security Issue [ 10292 ]
            Tristan Tarrant made changes -
            Summary Original: Non-admins should not be able to get cache config via REST API New: CVE-2023-14986 Non-admins should not be able to get cache config via REST API
            Tristan Tarrant made changes -
            Summary Original: CVE-2023-14986 Non-admins should not be able to get cache config via REST API New: CVE-2023-3629 Non-admins should not be able to get cache config via REST API
            Ryan Emerson made changes -
            Fix Version/s New: 15.0.0.Dev04 [ 12413880 ]
            Ryan Emerson made changes -
            Fix Version/s New: 14.0.18.Final [ 12413407 ]
            Resolution New: Done [ 1 ]
            Status Original: Pull Request Sent [ 10011 ] New: Resolved [ 5 ]
            Katia Aresti made changes -
            Link New: This issue causes ISPN-15198 [ ISPN-15198 ]
            Katia Aresti made changes -
            Link New: This issue causes JDG-6458 [ JDG-6458 ]
            Pedro Zapata Fernandez made changes -
            Workflow Original: GIT Pull Request with Triage workflow [ 23769310 ] New: OJA-WF-BG [ 24698067 ]
            Tristan Tarrant made changes -
            Fix Version/s New: 15.0.0.Final [ 12377084 ]
            Tristan Tarrant made changes -
            Affects Version/s New: 15.0.0.Final [ 12377084 ]

              ttarrant@redhat.com Tristan Tarrant
              ttarrant@redhat.com Tristan Tarrant
              Archiver:
              rhn-support-adongare Amol Dongare

                Created:
                Updated:
                Resolved:
                Archived: