| タイトル | dibo-software diboot v3.8.0 Broken Access Control |
|---|
| 説明 | The tenant resource assignment endpoints expose a tenant-scoped Broken Access Control issue. The controller accepts a caller-supplied tenantId directly in both the read and write routes,then forwards it to the service layer without checking whether the authenticated user actually owns that tenant or has any management authority over it. In GET /api/iam/tenant/resource/{tenantId}, the API returns the tenant’s current resource IDs by querying only on tenantId. In POST /api/iam/tenant/resource/{tenantId}, the API rewrites the many-to-many tenant-resource mapping by passing the same tenantId and attacker-controlled ids list into the relation update helper. Because there is no object-level permission check and no tenant boundary validation, any authenticated user who knows or guesses a valid tenantId can enumerate that tenant’s authorization set and arbitrarily grant or revoke permissions. |
|---|
| ソース | ⚠️ https://drive.google.com/file/d/1qFtwq78JN5Af3GlSD2utfQIbOPBaaQ47/view?usp=sharing |
|---|
| ユーザー | Stephen Lin (UID 98370) |
|---|
| 送信 | 2026年07月01日 09:41 (2 月 ago) |
|---|
| モデレーション | 2026年08月31日 07:33 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 397235 [dibo-software diboot 3.8.0 Tenant Resource Assignment /api/iam/tenant/resource tenantId 特権昇格] |
|---|
| ポイント | 20 |
|---|