CVE-2017-8907 - Incorrect Authorization

Severity

65%

Complexity

80%

Confidentiality

106%

Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 did not correctly check if a user creating a deployment project had the edit permission and therefore the rights to do so. An attacker who can login to Bamboo as a user without the edit permission for deployment projects is able to use this vulnerability, provided there is an existing plan with a green build, to create a deployment project and execute arbitrary code on an available Bamboo Agent. By default a local agent is enabled; this means that code execution can occur on the system hosting Bamboo as the user running Bamboo.

CVSS 3.0 Base Score 8.8. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS 2.0 Base Score 6.5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:S/C:P/I:P/A:P).

Demo Examples

Incorrect Authorization

CWE-863

The following code could be for a medical records application. It displays a record to already authenticated users, confirming the user's authorization using a value stored in a cookie.


               }}setcookie("role", $role, time()+60*60*2);
die("\n");
DisplayMedicalHistory($_POST['patient_ID']);
die("You are not Authorized to view this record\n");

The programmer expects that the cookie will only be set when getRole() succeeds. The programmer even diligently specifies a 2-hour expiration for the cookie. However, the attacker can easily set the "role" cookie to the value "Reader". As a result, the $role variable is "Reader", and getRole() is never invoked. The attacker has bypassed the authorization system.

Overview

Type

Atlassian Bamboo

First reported 7 years ago

2017-06-14 20:29:00

Last updated 5 years ago

2019-10-03 00:03:00

Affected Software

Atlassian Bamboo 5.0

5.0

Atlassian Bamboo 5.0 Beta1

5.0

Atlassian Bamboo 5.0 Beta2

5.0

Atlassian Bamboo 5.0 Beta3

5.0

Atlassian Bamboo 5.0 Release Candidate 1

5.0

Atlassian Bamboo 5.0.1

5.0.1

Atlassian Bamboo 5.1

5.1

Atlassian Bamboo 5.1.1

5.1.1

Atlassian Bamboo 5.2

5.2

Atlassian Bamboo 5.2.1

5.2.1

Atlassian Bamboo 5.2.2

5.2.2

Atlassian Bamboo 5.3

5.3

Atlassian Bamboo 5.4

5.4

Atlassian Bamboo 5.4.1

5.4.1

Atlassian Bamboo 5.4.2

5.4.2

Atlassian Bamboo 5.5

5.5

Atlassian Bamboo 5.6

5.6

Atlassian Bamboo 5.6.1

5.6.1

Atlassian Bamboo 5.6.2

5.6.2

Atlassian Bamboo 5.7

5.7

Atlassian Bamboo 5.7.1

5.7.1

Atlassian Bamboo 5.7.2

5.7.2

Atlassian Bamboo 5.8

5.8

Atlassian Bamboo 5.8.1

5.8.1

Atlassian Bamboo 5.8.2

5.8.2

Atlassian Bamboo 5.8.5

5.8.5

Atlassian Bamboo 5.9

5.9

Atlassian Bamboo 5.9.1

5.9.1

Atlassian Bamboo 5.9.2

5.9.2

Atlassian Bamboo 5.9.3

5.9.3

Atlassian Bamboo 5.9.4

5.9.4

Atlassian Bamboo 5.9.7

5.9.7

Atlassian Bamboo 5.11.3

5.11.3

Atlassian Bamboo 5.12.0

5.12.0

Atlassian Bamboo 5.12.1

5.12.1

Atlassian Bamboo 5.12.2

5.12.2

Atlassian Bamboo 5.12.4

5.12.4

Atlassian Bamboo 5.12.5

5.12.5

Atlassian Bamboo 5.13.0

5.13.0

Atlassian Bamboo 5.13.1

5.13.1

Atlassian Bamboo 5.13.2

5.13.2

Atlassian Bamboo 5.14.0

5.14.0

Atlassian Bamboo 5.14.1

5.14.1

Atlassian Bamboo 5.14.2

5.14.2

Atlassian Bamboo 5.14.3

5.14.3

Atlassian Bamboo 5.14.4.1

5.14.4.1

Atlassian Bamboo 5.14.5

5.14.5

Atlassian Bamboo 5.15.15

5.15.0

Atlassian Bamboo 5.15.2

5.15.2

Atlassian Bamboo 5.15.3

5.15.3

Atlassian Bamboo 5.15.4

5.15.4

Atlassian Bamboo 5.15.5

5.15.5

Atlassian Bamboo 6.0.0

6.0.0

References

99090

Third Party Advisory, VDB Entry

https://confluence.atlassian.com/bamboo/bamboo-security-advisory-2017-06-14-907283498.html

Vendor Advisory