Uploaded image for project: 'Couchbase Server'
  1. Couchbase Server
  2. MB-22759

N1QL insert/delete/update operations incorrectly authorized

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Major
    • 5.0.0
    • 5.0.0
    • ns_server
    • None

    Description

      To reproduce using build Enterprise Edition 5.0.0-1965 build 1965,

      • Create a bucket closed1 with a password.
      • Create a user with only delete permission on this bucket:
        curl -X PUT http://localhost:8091/settings/rbac/users/builtin/deleter -d "name=Deleter&roles=data_reader_writer[closed2],query_delete[closed2]&password=pwdeleter" -u Administrator:password
      • Using cbauth, authorize as deleter:pwdeleter, and request permission cluster.bucket[closed2].n1ql.insert!execute. This permission is granted, but should not be.

      Unfortunately I don't have an end-to-end reproducer. The code in the query engine that asks for statement type permissions is currently commented out, since it would break access to open (no-password) buckets. Let me know if you need a specially-built query engine, and I'll provide one.

      Ref: test case 6.b), 7.c)

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            johan.larson Johan Larson (Inactive)
            johan.larson Johan Larson (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes

                PagerDuty