Posted by
Si Chen-2 on
URL: http://ofbiz.116.s1.nabble.com/Users-Hidden-partyId-Security-Risk-tp137366p137372.html
Vinay,
My hunch is that:
ServiceUtil.getPartyIdCheckSecurity(userLogin, security, context,
result, "PAY_INFO", "_UPDATE");
is not enough. This checks if the partyId of the userLogin is the
partyId in the context or if the userLogin has PAY_INFO_UPDATE.
I think the security check there should be:
1. Does userLogin have PAY_INF_UPDATE? Yes -> good. This can be done
with hasEntityPermission
2. If not (1), is the userLogin the partyId in the context AND the
partyId of the PaymentMethod? Yes -> good.
We may be missing the second part here...
Want to try it? :)
Si
Vinay Agarwal wrote:
> My testing did find problem with hidden paymentMethodId field that I
> am describing below. In addition, there are 240 other ftl files that
> contain hidden fields and may pose security risk although I have not
> looked at anyone else.
>
> File: applications/ecommerce/webapp/ecommerce/customer/editcreditcard.ftl
>
> Statement: <input type="hidden" name="paymentMethodId"
> value="${paymentMethodId}">
>
> Theory:
>
> A hacked form may change the paymentMethodId and modify data that the
> user does not have authorization for
>
> Method:
>
> 1. Ecommerce application, signed up as “firstuser” and added a
> credit card. Its paymentMethodId came out to be 10000.
> 2. Logged out and signed up as “seconduser” and added a credit
> card. Its paymentMethodId came out to be 10001.
> 3. Logged in as seconduser, clicked on update credit card. Saved
> the html page locally.
> 4. Edited the saved html page
> 1. Changed paymentMethodId from 10001 to 10000.
> 2. Added
http://localhost:8443 <
http://localhost:8443/> to
> the action url.
> 5. Expected result: firstuser and seconduser each has one credit card.
> 6. Actual result: firstuser had no card and the second user had 2
> cards as seen on the profile page.
>
> Conclusion:
>
> A user is able to modify data that he is not authorized for.
>
> I would like to know if you can reproduce it. I can add it to Jira if
> needed.
>
> Regards,
>
> Vinay Agarwal
>
>------------------------------------------------------------------------
>
>
>_______________________________________________
>Users mailing list
>
[hidden email]
>
http://lists.ofbiz.org/mailman/listinfo/users>
_______________________________________________
Users mailing list
[hidden email]
http://lists.ofbiz.org/mailman/listinfo/users