bernardodemarco opened a new pull request, #13828:
URL: https://github.com/apache/cloudstack/pull/13828
### Description
A workflow introduced in the API key pair restructure tries to retrieve the
accessing API key contained in HTTP requests by looking up for the `apiKey`
string in a case-sensitive way. However, when verifying a request, the
Management Server also accepts the API key to be specified in lowercase
(`apikey`). The same behavior happens for the `signature` parameter.
Thus, if the API key is specified as `apikey` in HTTP requests, the key pair
validation workflow does not identify the key used for authentication and it
assumes that they are established via session. This behavior can leak key pairs
with broader permission sets than the accessing pair actually has. These leaks
can only happen for pairs belonging to the same user; one user from one account
is not able to access keys from another user of another account.
Another incorrect behavior was found out, which allows for an accessing API
key with a limited permission scope to register other pairs with all the
permissions of the corresponding user's account. This is possible when no
explicit permissions are defined and, under these circumstances, the
registration workflow assumes the authentication was performed with an
accessing pair without any explicit permissions as well.
This PR fixes all these reported issues.
### Types of changes
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [X] Bug fix (non-breaking change which fixes an issue)
- [ ] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
- [ ] Build/CI
- [ ] Test (unit or integration test code)
### Feature/Enhancement Scale or Bug Severity
#### Bug Severity
- [ ] BLOCKER
- [X] Critical
- [ ] Major
- [ ] Minor
- [ ] Trivial
### Screenshots (if appropriate):
### How Has This Been Tested?
- I created an API key pair with the following permissions. This pair was
used for the execution of all described test cases, except when informed
otherwise:
<details>
<summary>API key pair permissions</summary>
```json
"permissions": [
{
"permission": "allow",
"rule": "listUserKey*"
},
{
"permission": "allow",
"rule": "listApis"
},
{
"permission": "allow",
"rule": "registerUserKeys"
},
{
"permission": "allow",
"rule": "getUserKeys"
}
]
```
</details>
### Leak of key pairs belonging to the same user
- I executed the `listUserKeys` API with the key pair created in the
previous step
- I verified that its return did not include other API key pairs with
larger permission sets
- I executed the `getUserKeys` API
- I verified that its return did not include other API key pairs with
larger permission sets
### Registration of key pairs with a broader permission scope
- I executed the `registerUserKeys` API without specifying explicit rules
- I verified that the new key pair permission set was equal to the set of
the key pair used to perform the request
- I executed the `registerUserKeys` API specifying a rule set belonging to
the set of the key pair used to perform the request
- I verified that the new key pair was successfully registered
- I executed the `registerUserKeys` API specifying rules which the accessing
key pair does not have access to
- I verified the the command execution was not successful
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
