[
https://issues.apache.org/jira/browse/CLOUDSTACK-5145?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Kishan Kavala resolved CLOUDSTACK-5145.
---------------------------------------
Resolution: Fixed
> ListNetworkACL API should list ACLs owned by the user only
> ----------------------------------------------------------
>
> Key: CLOUDSTACK-5145
> URL: https://issues.apache.org/jira/browse/CLOUDSTACK-5145
> Project: CloudStack
> Issue Type: Bug
> Security Level: Public(Anyone can view this level - this is the
> default.)
> Reporter: Kishan Kavala
> Assignee: Kishan Kavala
> Priority: Blocker
> Fix For: 4.2.1, 4.3.0
>
>
> ListNetworkACL API should filter ACLs by caller and list ACLs which can be
> accessed by the user only.
> If API call is not called with a networkid or other filter, every ACL in the
> system is dumped, which is both a performance issue and a security issue. If
> a networkid is provided, but the network doesn't have an ACL list or any ACL
> items attached, the same issue occurs.
> Likewise, listNetworkACLLists gives access to see non-owned lists, which in
> turn gives vpc ids for non-owned resources.
> Example:
> 1. Set up a zone
> 2. Create a VPC or network as admin
> 3. Create an ACL list for the network
> 4. Create a new domain and unprivileged user
> 5. Generate API keys for user
> 6. Issue a 'listNetworkACLs' API call. You should see the ACL list items from
> the admin-owned list
> 7. Issue a 'listNetworkACLLists' API call referencing aclid from non-owned
> acl item. You should see the acl list info and which vpc it belongs to.
> 8. Listing the vpc attached to the acl list properly stops with an
> 'unauthorized' response as step 7 above should.
--
This message was sent by Atlassian JIRA
(v6.1.4#6159)
