Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

Security Hole: "New Job..." UI button bypasses aclpolicy file entries

#403

In a project where an end-user is configured to have read-only access to some job folders, and read/write/create access to others via the .aclpolicy file, enabling the ui/create ACL bypasses the security placed on the read-only folder structure during job creation time, allowing the user to create and execute (one time only) a job in the previously restricted folder space.

Reported by Steven Kluth · July 28th, 2011 @ 02:04 PM

State: resolved
Milestone: Rundeck 1.4
Assigned to: Greg Schueler Greg Schueler

Activity

  1. Deleted User
    Deleted User

    Do you mind sharing your aclpolicy?

    July 29th, 2011 @ 09:41 AM

  2. Greg Schueler
    Greg Schueler
    • Assigned user set to Greg Schueler
    • Tag set to aclpolicy, authorization, bug
    • Milestone set to Rundeck 1.4
    • Milestone order changed from 79 to 0

    September 7th, 2011 @ 11:29 AM

  3. Greg Schueler
    Greg Schueler
    • State changed from new to open

    September 7th, 2011 @ 11:38 AM

  4. Greg Schueler
    Greg Schueler
    • State changed from open to needs_verification

    verify create/create and run job will fail to work if saving to restricted group path

    September 9th, 2011 @ 04:20 PM

  5. Greg Schueler
    Greg Schueler

    September 14th, 2011 @ 01:52 PM

  6. Greg Schueler
    Greg Schueler
    • State changed from needs_verification to resolved

    October 25th, 2011 @ 12:37 PM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.