Uploaded image for project: 'Couchbase Server'
  1. Couchbase Server
  2. MB-61656

Able to bypass columnar rbac through UDF

    XMLWordPrintable

Details

    • Untriaged
    • 0
    • Unknown

    Description

      1. Created a user 'testmohsin`;

      2. Created a standalone collection Default.JntAohHCnWxp.QlK and loaded 1k docs into the collection.

      3. Created a UDF 

      create analytics function Default.Default.testfunc(){select * from Default.JntAohHCnWxp.QlK} 

      4. Tried to run select query directly for user testmohsin

      select * from Default.JntAohHCnWxp.QlK; 

      But I get the following error since select privilege was not granted to the user.

      User must have permission (cluster.analytics.grant.COLLECTION[Default:JntAohHCnWxp:QlK]!SELECT) 

      5. Grant execute permissions on the created UDF to user testmohsin.

      grant execute on function testfunc to testmohsin; 

      6. Execute the UDF using user testmohsin

      testfunc() 

      The query now returns the docs in the collection

        "results": [        {            "QlK": {                "name": "1IljZjIx1u75",                "email": "a2qB8s2hDUkKakCWcREnnpptyoikcnh4DnW6E1M5A6KZdybeUTVSlqdg3A0EtBUsHhzeMOBWThasoeP@lnT1a.com",                "mutated": 0.0,                "padding": "",                "country": "Oman",                "address": "ooEcO4Ga9ViIc5vNBQkvJJfV9 HI1Vnp0XmhBz",                "free_parking": 1,                "document_size": 1024,                "city": "bVt85z ",                "type": "Hotel",                "characters_without_spaces": "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789",                "url": "www.a2qB8s2hDUkKakCWcREnnpptyoikcnh4DnW6E1M5A6KZdybeUTVSlqdg3A0EtBUsHhzeMOBWThasoeP.lnT1a.com",                "reviews": [                    {                        "date": "Thu Apr 25 16:32:44 IST 2024",                        "author": "levOFusYNnMSkgJPXMGX",                        "rating": {                            "cleanliness": 9.186595128148348,                            "overall": 1.3613884955615552,                            "value": 5.085538564905207                        }                    },                    {                        "date": "Thu Apr 25 16:32:44 IST 2024",                        "author": "bbigrgiOKoFUtWSTfP",                        "rating": {                            "cleanliness": 6.4582913874301,                            "overall": 9.173246104072124,                            "value": 0.24651701643666035                        }                    },                    {                        "date": "Thu Apr 25 16:32:44 IST 2024",                        "author": "TqjcMtOIiH",                        "rating": {                            "cleanliness": 1.979994957121075,                            "overall": 0.06494201195496596,                            "value": 5.451288383363002                        }                    },                    {                        "date": "Thu Apr 25 16:32:44 IST 2024",                        "author": "cwVqRIPGGWy bh",                        "rating": {                            "cleanliness": 3.83630676349621,                            "overall": 9.19655695884349,                            "value": 4.264926547054539                        }                    },                    {                        "date": "Thu Apr 25 16:32:44 IST 2024",                        "author": "tNjrIiiL yiIGdI",                        "rating": {                            "cleanliness": 6.542944546252708,                            "overall": 7.132671078246827,                            "value": 7.421296380834612                        }                    },                    {                        "date": "Thu Apr 25 16:32:44 IST 2024",                        "author": "CfebsuFaADEnlQD",                        "rating": {                            "cleanliness": 2.179371688755557,                            "overall": 2.2119127129577922,                            "value": 7.874557890744519                        }                    }                ],                "phone": 2751345,                "price": 3000.0,                "avg_rating": 0.7279873869926251,                "characters_with_spaces": "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 ",                "free_breakfast": 1,                "public_likes": []            }        },        {            "QlK": {                "name": "3I6aoLsI5Bp",                "email": "1G3MN6FDpw0YYQ44EBJsLZm4w0wE@FpJiOYv.com",                "mutated": 0.0,                "padding": "",                "country": "Vietnam",                "address": "000OVWERW6mWsOXxVEunQtInzfbUWIIEuoYvhW2ZGbIZVUqdD rfXKNESoywNHmuR9nxA3iDSocR9wfXjsuv8zgJPg3mc",                "free_parking": 1,                "document_size": 1024,                "city": "GrnwuLYVWXDAd6e8Wl",                "type": "Hotel",                "characters_without_spaces": "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789",                "url": "www.1G3MN6FDpw0YYQ44EBJsLZm4w0wE.FpJiOYv.com",                "reviews": [                    {                        "date": "Thu Apr 25 16:32:44 IST 2024",                        "author": "ctpNMmRghhEOF ",                        "rating": {                            "cleanliness": 1.7164927533651453,                            "overall": 8.153646651512824,                            "value": 8.614485202804339                        }                    },                    {                        "date": "Thu Apr 25 16:32:44 IST 2024",                        "author": "NIaDsiWkDdUAL",                        "rating": {                            "cleanliness": 9.911089559075496,                            "overall": 3.3376881387081605,                            "value": 1.8098403186780776                        }                    }                ],                "phone": 6606375,                "price": 5000.0,                "avg_rating": 0.21278432788137835,                "characters_with_spaces": "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 ",                "free_breakfast": 0,                "public_likes": [                    "saW5XafPNE"                ]            }
      .
      .
      .
      . 

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            mohsin.ahmed Mohsin Ahmed
            mohsin.ahmed Mohsin Ahmed
            Votes:
            0 Vote for this issue
            Watchers:
            8 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes

                PagerDuty