PT-2020-12489 · Rundeck · Rundeck
Justine Osborne
·
Published
2020-04-29
·
Updated
2021-09-14
·
CVE-2020-11009
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Rundeck versions prior to 3.2.6
Description
The issue allows authenticated users to craft a request that reveals Execution data and logs and Job details that they are not authorized to see. Depending on the configuration and the way that Rundeck is used, this could result in anything between a high severity risk, or a very low risk. If access is tightly restricted and all users on the system have access to all projects, this is not really much of an issue. If access is wider and allows login for users that do not have access to any projects, or project access is restricted, there is a larger issue. If access is meant to be restricted and secrets, sensitive data, or intellectual property are exposed in Rundeck execution output and job data, the risk becomes much higher. An authenticated user could craft a request to view Executions and download execution logs without access to
read or view the associated Job, or ad-hoc resource. Some authenticated API requests were not correctly checking appropriate authorization levels.Recommendations
Upgrade to Rundeck version 3.2.6 to resolve the issue. As a temporary workaround, consider restricting access to sensitive data and intellectual property exposed in Rundeck execution output and job data until the patch is applied. Restrict access to the
read and view functions for Jobs and ad-hoc resources to minimize the risk of exploitation. Avoid using the run access to the Job without proper authorization until the issue is resolved.Fix
Information Disclosure
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Rundeck