Bug 463809 - [Security] addInitialParticipant remote method allows privilege escalation
Summary: [Security] addInitialParticipant remote method allows privilege escalation
Status: CLOSED FIXED
Alias: None
Product: EMFStore
Classification: Modeling
Component: ServerCore (show other bugs)
Version: 1.4.1   Edit
Hardware: PC All
: P3 blocker (vote)
Target Milestone: 1.4.3   Edit
Assignee: Project Inbox CLA
QA Contact:
URL:
Whiteboard:
Keywords: security
Depends on:
Blocks:
 
Reported: 2015-04-02 09:38 EDT by Edgar Mueller CLA
Modified: 2015-05-11 06:16 EDT (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Edgar Mueller CLA 2015-04-02 09:38:15 EDT 

    


    


      



        
          Comment 1
        

        
          Eclipse Genie CLA

        

        
        

        
          2015-04-02 09:57:52 EDT
        

      






New Gerrit change created: https://git.eclipse.org/r/45139

    


    


      



        
          Comment 2
        

        
          Maximilian Koegel CLA

        

        
        

        
          2015-04-08 09:38:57 EDT
        

      






AdminEMFStore.addInitialParticipant is a method that is available to remote EMFStore clients, e.g. via XMLRPC to add roles to a user. It was introduced to be able to assign the ProjectAdmin role to a user that has just created a project.
Calls to the methods are not sufficiently restricted to prevent escalating the privileges of authenticated users. In the worst case malicious clients can escalate their privileges of a user to server admin, which will provide full access to all projects on the server. Please note that a user still needs to provide valid credentials in this case and the malicious client needs to either directly access the server via XMLRPC or it needs to use internal API in the EMFStore client code. 

The proposed fix will reject calls in three additional cases:
1. Reject calls to the method if the respective flag for assigning project admin rights to newly shared projects by default is turned OFF.
2. Reject calls to the method that try to add server admin roles to the current user
3. Reject calls to the method adding any role to a project which was not created with the same session ID as the current call.

    


    

    


      



        
          Comment 4
        

        
          Eclipse Genie CLA

        

        
        

        
          2015-04-15 04:29:30 EDT
        

      






New Gerrit change created: https://git.eclipse.org/r/45848