Flaw in Pulp Package Allows Oldest User with Task Permissions to Control Object Creation

CVE-2024-7143

What is CVE-2024-7143?

A vulnerability exists in the Pulp package due to a flaw in the configuration of role-based access control (RBAC) settings. When a RBAC object is created, the process for assigning permissions incorrectly utilizes the AutoAddObjPermsMixin, specifically the add_roles_for_object_creator method. This method determines the object creator based on the current authenticated user; however, if the object is created within a task, the user with the earliest permissions to the task will be designated as the current user. This results in situations where the actual creator of the task does not receive appropriate permissions, allowing the oldest user with model/domain-level task permissions to exploit this flaw. Consequently, all objects generated in tasks end up with permissions linked to this oldest user, undermining the intended access control measures.

References