REDHAT-BUG-2487069: High severity migration-planner vulnerability
Repository: migration-planner Priority: High Location: internal/handlers/v1alpha1/source.go:236
Description: GET /api/v1/sources/{id}/image-url returns presigned S3 URLs for OVA appliances. Unlike sibling endpoints (GetSource/UpdateSource/DeleteSource), this handler skips the user.Organization == source.OrgID ownership check and proceeds directly to URL generation. Any bearer token plus victim's source UUID yields a download link.
Security Impact:
OVA embeds victim's long-lived agent JWT and source configuration
Attacker gains credential to write to victim's source (when combined with f002)
Discloses proxy/network configuration
UUIDv4 entropy is insufficient when UUIDs appear in shared assessments, support tickets, browser history
Fix Suggestion: Fetch the source first, compare user.Username/user.Organization against source.Username/source.OrgID, and return 404 on mismatch (not 403 to avoid existence oracle). Long-term: wrap SourceService in an Authz decorator. See patches/f003.patch.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2487069?
The severity of REDHAT-BUG-2487069 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2487069?
To fix REDHAT-BUG-2487069, review the access controls for the GET /api/v1/sources/{id}/image-url endpoint to ensure it respects user organization restrictions.
What vulnerabilities does REDHAT-BUG-2487069 expose?
REDHAT-BUG-2487069 exposes the risk of unauthorized access to presigned S3 URLs for OVA appliances.
When was REDHAT-BUG-2487069 published?
REDHAT-BUG-2487069 was published on June 9, 2026.
Where is the vulnerable code located in REDHAT-BUG-2487069?
The vulnerable code for REDHAT-BUG-2487069 is located in internal/handlers/v1alpha1/source.go at line 236.