Skip to content

Improper Access Control on disabling a user. #3343

Closed
Closed
Improper Access Control on disabling a user.#3343
Labels
SECURITYA security issue reported through CVEbugUndesired behaviourresolvedA fixed issue
Milestone
1.2.11

Description

@sh0lt0
sh0lt0
opened on Mar 11, 2020

Describe the bug
Cacti admin console provides a functionality to disable a created user which takes his privileges to perform any action but if a page is auto-refreshed a disabled user can view updated data.

To Reproduce
Steps to reproduce the behavior:

  1. Log in with Admin account and navigate to http://192.168.56.106/cacti/user_admin.php?action=user_edit&id=5&tab=realms
  2. Give the new user permission to view logs.
  3. Login to new user's account and navigate http://192.168.56.106/cacti/clog_user.php
  4. From Admin's account disable the created user.

Actual behavior
A disabled user can view the system logs and the logs are even updating after the refresh time.
Expected behavior
A disabled user should not be privileged to view the system logs.

  • OS: Ubuntu
  • Browser: Firefox
  • Version - Cacti 1.2.8

Activity

  1. TheWitness commented on Mar 12, 2020

    @TheWitness
    TheWitness
    on Mar 12, 2020
    Member

    Yea, the credentials are cached. Thought there was a mechanism to have the credentials replayed when the admin makes a change to the user account.

  2. TheWitness
    added
    enhancementGeneral tag for an enhancement
    on Mar 12, 2020

  3. sh0lt0 commented on Mar 13, 2020

    @sh0lt0
    sh0lt0
    on Mar 13, 2020
    Author

    I understand that permission propagation takes time but it is assumed the best security practice to implement expiry time to the cache.

  4. TheWitness
    added
    bugUndesired behaviour
    SECURITYA security issue reported through CVE
    and removed
    enhancementGeneral tag for an enhancement
    on Mar 13, 2020
  5. TheWitness
    added a commit that references this issue on Mar 13, 2020

    Fixing Issue #3343 and outstanding issue with #3342

    25abe64
  6. TheWitness
    added
    resolvedA fixed issue
    on Mar 13, 2020
  7. TheWitness
    added this to the 1.2.11 milestone on Mar 13, 2020
  8. TheWitness
    closed this as completedon Mar 17, 2020
  9. TheWitness
    added a commit that references this issue on Mar 24, 2020

    Regression related to automatic logout and guest account for issue #3343

    ec0d1f8
  10. github-actions
    locked and limited conversation to collaborators on Jun 30, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    SECURITYA security issue reported through CVEbugUndesired behaviourresolvedA fixed issue

    Type

    No type

    Projects

    No projects

      Milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions