Greg Mann created MESOS-5685:
--------------------------------
Summary: The /files/download endpoint authorization can be
compromised
Key: MESOS-5685
URL: https://issues.apache.org/jira/browse/MESOS-5685
Project: Mesos
Issue Type: Bug
Affects Versions: 0.28.2
Reporter: Greg Mann
If a forward slash is appended to the path of a file a user wishes to download
via {{/files/download}}, the authorization logic for that path will be bypassed
and the file will be downloaded regardless of permissions. This is because we
store the authorization callbacks for these paths in a map which is keyed by
the path name, so a request to {{/master/log/}} fails to find the callback
which is installed for {{/master/log}}. When the master fails to find the
callback, it assumes authorization is not required for that path and authorizes
the action.
Consider the following excerpt:
{code}
gmann@gmac:~/src/mesos/build⚡ http GET
http://127.0.0.1:5050/files/download\?path\=/master/log -a foo:bar
HTTP/1.1 403 Forbidden
Content-Length: 0
Date: Wed, 22 Jun 2016 21:28:53 GMT
gmann@gmac:~/src/mesos/build⚡ http GET
http://127.0.0.1:5050/files/download\?path\=/master/log/ -a foo:bar
HTTP/1.1 200 OK
Content-Disposition: attachment;
filename=mesos-master.gmac.gmann.log.INFO.20160622-142843.65615
Content-Length: 14432
Content-Type: application/octet-stream
Date: Wed, 22 Jun 2016 21:28:56 GMT
Log file created at: 2016/06/22 14:28:43
Running on machine: gmac
Log line format: [IWEF]mmdd hh:mm:ss.uuuuuu threadid file:line] msg
I0622 14:28:43.476925 2080764672 logging.cpp:194] INFO level logging started!
I0622 14:28:43.477522 2080764672 main.cpp:367] Using 'HierarchicalDRF' allocator
I0622 14:28:43.480650 2080764672 leveldb.cpp:174] Opened db in 2961us
I0622 14:28:43.481046 2080764672 leveldb.cpp:181] Compacted db in 372us
I0622 14:28:43.481078 2080764672 leveldb.cpp:196] Created db iterator in 13us
I0622 14:28:43.481096 2080764672 leveldb.cpp:202] Seeked to beginning of db in
9us
I0622 14:28:43.481111 2080764672 leveldb.cpp:271] Iterated through 0 keys in
the db in 8us
I0622 14:28:43.481165 2080764672 replica.cpp:779] Replica recovered with log
positions 0 -> 0 with 1 holes and 0 unlearned
I0622 14:28:43.481967 219914240 recover.cpp:451] Starting replica recovery
I0622 14:28:43.482193 219914240 recover.cpp:477] Replica is in EMPTY status
I0622 14:28:43.482589 2080764672 main.cpp:488] Creating default 'local'
authorizer
I0622 14:28:43.482719 2080764672 main.cpp:545] Starting Mesos master
I0622 14:28:43.483085 218841088 replica.cpp:673] Replica in EMPTY status
received a broadcasted recover request from (4)@127.0.0.1:5050
I0622 14:28:43.487284 218304512 recover.cpp:197] Received a recover response
from a replica in EMPTY status
I0622 14:28:43.487694 219914240 recover.cpp:568] Updating replica status to
STARTING
{code}
We could consider disallowing paths which end in trailing slashes.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
