cloudstack-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Abhinandan Prateek (JIRA)" <>
Subject [jira] [Commented] (CLOUDSTACK-5145) ListNetworkACL API should list ACLs owned by the user only
Date Thu, 05 Dec 2013 06:14:36 GMT


Abhinandan Prateek commented on CLOUDSTACK-5145:

Ref Email discussion is with subject "api incompatibility between 4.1 and 4.2 in ACLs"

> ListNetworkACL API should list ACLs owned by the user only
> ----------------------------------------------------------
>                 Key: CLOUDSTACK-5145
>                 URL:
>             Project: CloudStack
>          Issue Type: Bug
>      Security Level: Public(Anyone can view this level - this is the default.) 
>            Reporter: Kishan Kavala
>            Assignee: Kishan Kavala
>            Priority: Blocker
>             Fix For: 4.2.1, 4.3.0
> ListNetworkACL API should filter ACLs by caller and list ACLs which can be accessed by
the user only. 
> If API call is not called with a networkid or other filter, every ACL in the system is
dumped, which is both a performance issue and a security issue. If a networkid is provided,
but the network doesn't have an ACL list or any ACL items attached, the same issue occurs.
> Likewise, listNetworkACLLists gives access to see non-owned lists, which in turn gives
vpc ids for non-owned resources.
> Example:
> 1. Set up a zone
> 2. Create a VPC or network as admin
> 3. Create an ACL list for the network
> 4. Create a new domain and unprivileged user
> 5. Generate API keys for user
> 6. Issue a 'listNetworkACLs' API call. You should see the ACL list items from the admin-owned
> 7. Issue a 'listNetworkACLLists' API call referencing aclid from non-owned acl item.
You should see the acl list info and which vpc it belongs to. 
> 8. Listing the vpc attached to the acl list properly stops with an 'unauthorized' response
as step 7 above should.

This message was sent by Atlassian JIRA

View raw message