Nadav Har'El created CASSANDRA-21768:
----------------------------------------
Summary: LIST PERMISSIONS ON ROLE r OF <own role> still reveals
whether role r exists
Key: CASSANDRA-21768
URL: https://issues.apache.org/jira/browse/CASSANDRA-21768
Project: Apache Cassandra
Issue Type: Bug
Reporter: Nadav Har'El
CASSANDRA-21560 moved the existence checks in ListPermissionsStatement after
the authorization check, so that a user who may not list a role's permissions
can't use the "doesn't exist" error to find out which roles exist. But any user
is authorized to list its *own* permissions, on any resource - including a role
resource. So the existence check of the ON resource still leaks:
{code:java}
-- as an ordinary user u, with no permissions at all:
LIST ALL PERMISSIONS ON ROLE some_existing_role OF u; -- succeeds, empty
result
LIST ALL PERMISSIONS ON ROLE no_such_role OF u; -- InvalidRequest:
<role no_such_role> doesn't exist
{code}
So any logged-in user can still check which role names exist, which
CASSANDRA-21560 meant to prevent.
Reproduced on Cassandra 5.0.9 and 6.0-alpha2. In trunk (as of commit
4ab8bac4a5), ListPermissionsStatement.execute() still throws "doesn't exist"
for a missing ON resource after IAuthorizer.list() has authorized the listing
of the user's own permissions, so trunk has the same leak.
A possible fix: for a role resource, check its existence only if the user may
view that role (superuser, or DESCRIBE or AUTHORIZE on that role or on all
roles); otherwise, just return the (empty) listing, as for an existing role on
which the user has no permissions.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
