EIQ-2021-0014

EIQ-2021-0014

-

Users with only modify workspaces permissions can add or remove collaborators on a workspace they have access to

17 August 2021

1 - LOW

CVSSv3 score not available on NIST NVD

2.11.0

An attacker with these permissions:

• modify workspaces

• read graphs (to avoid crashing the UI)

Can:

1. Create a new user account for the attacker (“User_attacker”). This user should be the sole member of their group.

2. Create an empty workspace (“Workspace_1”).

3. Add the attacker (“User_attacker”) to the workspace (“Workspace_1”) as a collaborator.

4. As the attacker (“User_attacker”), send a PUT /private/workspaces/{id} request.

   In the payload, send a list of users to add them to the workspace as collaborators:

   { "data": {

   "user_roles": [

   { "user": <user_id>,

   "role": "collaborator"

   },

   { ... }

   ]

   }

   }

Expected:

Users should only be able to add user accounts they can access to their workspaces as collaborators.

Planned fix where platform enforces permissions correctly.

2.10.x and earlier

N/A