[RANGER-3616] Security Risk. ugsync API can create a hidden user.

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 3.0.0, 2.2.0
• Component/s: Ranger, usersync
• Assignee: Unassigned
• Reporter: kirby zhou
• Created: 11/Feb/22 02:27
• Updated: 11/Feb/22 02:28

Description

We can use  REST API /service/xusers/ugsync/users to create a User without 

userRoleList. And the user is hidden in Ranger Admin User List.

 

#] curl -u: --negotiate --header 'Content-Type: application/json' --data '{"vXUsers" :[

{"name":"hehe", "description" : "hehe", "syncSorce": "Unix"}

], "totalCount" : 1}' 'http://kirbytest01.sa:6080/service/xusers/ugsync/users' 

1

The user "hehe" is created, but can not be seen at WebUI 

But it be used at policies, it should be a security risk.