Incorrect authorization in Corteza - #VU156190

Vulnerability details

The vulnerability allows a remote user to execute role-restricted Corredor server scripts and invoke privileged business logic with controlled arguments.

The vulnerability exists due to incorrect authorization in Corredor's serverScriptSecurity and canExec functions when handling explicit onManual server script execution requests. A remote user can submit script and args fields to POST /api/system/automation/trigger or POST /api/compose/automation/trigger to execute a registered script for the matching resource type despite not belonging to its security.allow roles, provided no security.deny entry blocks the user's roles.

For restricted scripts configured with runAs, enabling CORREDOR_RUN_AS_ENABLED causes execution with the configured runner context and generation of an authToken for that runner.

Affected software

Remediation

External References

• https://github.com/cortezaproject/corteza/security/advisories/GHSA-xq36-w6gr-q84q

Related Security Bulletins

• Multiple vulnerabilities in Corteza