EIQ-2019-0034

EIQ-2019-0034

-

A private API endpoint could provide access to unauthorized data sources

27 Sep 2019

0 - UNKNOWN

CVSSv3 score not available on NIST NVD.

2.6.0

The /private/entity-groups/${group_uuid} platform private API endpoint does not properly check source access permissions. This could enable a platform user to access platform resources they could normally not be able to access with the roles and permissions they are currently assigned.

A signed-in user with at least the read entities permission, and without admin access rights, could use a command line HTTP client to send a request to the endpoint, and to download entities originating from the same ingested package.

A signed-in platform user with the read entities permission could retrieve a group UUID from a pinned entity on a shared workspace, for example.
Then, they could include the retrieved group UUID as a URL parameter, and they could send a cURL request to /private/entity-groups/${group_uuid} .
This would give them access to ingested packages having the group as a data source, and to the entities included in the packages.

None at this time.

2.5.0 and earlier.

-