CVE-2014-0087: High severity red hat cloudforms management engine vulnerability

Jan Rusnacko of the Red Hat Product Security Team reports:

CFME contains an authorization bypass issue in the action rbacuseredit, which allows authenticated users with minimal privileges to gain access to additional privileges.

The problem is in the method checkprivileges in vmdb/app/controllers/applicationcontroller.rb:

def checkgenericrbac ident = "#{controllername}#{actionname}"

if MiqProductFeature.featureexists?(ident) passed = roleallows(:feature => ident, :any => true) unless passed if request.xmlhttprequest? render :update do |page| page.redirectto :controller => 'dashboard', :action => 'autherror' end else redirectto(:controller => 'dashboard', :action => 'autherror') end end passed else validateroute(controllername, request.env['REQUESTMETHOD'], actionname) end end

Since there is no else branch for the "if MiqProductFeature.featureexists?(ident)", any feature that is missing from the list of known features, will be allowed by default. One of these such features is opsrbacuseredit.

This is the same exact place in code that is causing CVE-2014-0078, however, the fix for this issue solves only CVE-2014-0078, not the problem itself. After the fix is applied, privileges for xbutton are checked, but other actions like rbacuseredit are allowed by default.