Uploaded image for project: 'Ranger'
  1. Ranger
  2. RANGER-3616

Security Risk. ugsync API can create a hidden user.

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Open
    • Major
    • Resolution: Unresolved
    • 3.0.0, 2.2.0
    • None
    • Ranger, usersync
    • None

    Description

      We can use  REST API /service/xusers/ugsync/users to create a User without 

      userRoleList. And the user is hidden in Ranger Admin User List.

       

      #] curl -u: --negotiate --header 'Content-Type: application/json' --data '{"vXUsers" :[

      {"name":"hehe", "description" : "hehe", "syncSorce": "Unix"}

      ], "totalCount" : 1}' 'http://kirbytest01.sa:6080/service/xusers/ugsync/users' 

      1

      The user "hehe" is created, but can not be seen at WebUI 

      But it be used at policies, it should be a security risk.

       

       

      Attachments

        1. 截屏2022-02-11 上午10.23.40.jpg
          111 kB
          kirby zhou
        2. 截屏2022-02-11 上午10.24.27.jpg
          253 kB
          kirby zhou

        Activity

          People

            Unassigned Unassigned
            kirbyzhou kirby zhou
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated: