From 7c60429f6c7a7c132725a789c8901aa5f29cad46 Mon Sep 17 00:00:00 2001 From: Martin Perina Date: Tue, 5 Mar 2024 10:10:37 +0800 Subject: [PATCH] CVE-2024-0822 commit 08daf9d2f17024d603a241cca85d00adf153a2f2 upstream Disable execution of CreateUserSession from GWT code CreateUserSesssion should be executed only as a part of login flow, so explicitly disable execution from GWT code. Signed-off-by: Martin Perina --- .../server/gwt/GenericApiGWTServiceImpl.java | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/frontend/webadmin/modules/frontend/src/main/java/org/ovirt/engine/ui/frontend/server/gwt/GenericApiGWTServiceImpl.java b/frontend/webadmin/modules/frontend/src/main/java/org/ovirt/engine/ui/frontend/server/gwt/GenericApiGWTServiceImpl.java index 476a018..00a886d 100644 --- a/frontend/webadmin/modules/frontend/src/main/java/org/ovirt/engine/ui/frontend/server/gwt/GenericApiGWTServiceImpl.java +++ b/frontend/webadmin/modules/frontend/src/main/java/org/ovirt/engine/ui/frontend/server/gwt/GenericApiGWTServiceImpl.java @@ -2,6 +2,7 @@ package org.ovirt.engine.ui.frontend.server.gwt; import java.io.IOException; import java.util.ArrayList; +import java.util.Arrays; import java.util.List; import java.util.UUID; import java.util.regex.Pattern; @@ -17,6 +18,7 @@ import org.ovirt.engine.core.common.action.ActionParametersBase; import org.ovirt.engine.core.common.action.ActionReturnValue; import org.ovirt.engine.core.common.action.ActionType; import org.ovirt.engine.core.common.constants.SessionConstants; +import org.ovirt.engine.core.common.errors.EngineFault; import org.ovirt.engine.core.common.interfaces.BackendLocal; import org.ovirt.engine.core.common.queries.QueryParametersBase; import org.ovirt.engine.core.common.queries.QueryReturnValue; @@ -149,6 +151,14 @@ public class GenericApiGWTServiceImpl extends OvirtXsrfProtectedServiceServlet i ArrayList multipleParams, boolean isRunOnlyIfAllValidationPass, boolean isWaitForResult) { log.debug("Server: RunMultipleAction invoked! [amount of actions: {}]", multipleParams.size()); //$NON-NLS-1$ + // CreateUserSession should never be invoked from GWT code + if (actionType == ActionType.CreateUserSession) { + ActionReturnValue error = new ActionReturnValue(); + error.setSucceeded(false); + error.setFault(new EngineFault(new RuntimeException("Command cannot be executed from client"))); //$NON-NLS-1$ + return Arrays.asList(error); + } + String correlationId = CorrelationIdTracker.getCorrelationId(); for (ActionParametersBase params : multipleParams) { params.setSessionId(getEngineSessionId()); @@ -168,6 +178,15 @@ public class GenericApiGWTServiceImpl extends OvirtXsrfProtectedServiceServlet i ActionParametersBase params) { log.debug("Server: RunAction invoked!"); //$NON-NLS-1$ debugAction(actionType, params); + + // CreateUserSession should never be invoked from GWT code + if (actionType == ActionType.CreateUserSession) { + ActionReturnValue error = new ActionReturnValue(); + error.setSucceeded(false); + error.setFault(new EngineFault(new RuntimeException("Command cannot be executed from client"))); //$NON-NLS-1$ + return error; + } + params.setSessionId(getEngineSessionId()); if (params.getCorrelationId() == null) { params.setCorrelationId(CorrelationIdTracker.getCorrelationId()); -- 2.27.0