access list owner can escalate his role to the highest roles
Timeline · export
Summary:
-
Go to [your-domain.teleport.sh/web/accesslists].
-
Create a new access list and add a role to "Roles Granted," e.g., "reviewer" role.
-
Add a user as the Access List Owner.
-
The user, as the Access List Owner, can escalate the role of the list to higher roles, thereby escalating their own account's role.
This is a prohibited procedure, as stated here, that Owners are not able to control what roles and traits are granted by the Access List.
Steps To Reproduce:
From Organization Owner Account:
-
Go to [your-domain.teleport.sh/web/accesslists].
-
Create a new access list.
-
Add a user as List Owner.
-
Add a role to "Roles Granted," e.g., "reviewer" role.
From Access List Owner Account:
-
Add a new member to the access list and intercept the request.
-
Add "editor" role on "grants roles."
-
The "editor" role will be added to "Permissions Granted."
-
Logout and relogin.
-
Now, the user has the "editor" role and can perform any action on the organization.
Impact
- Unauthorized Access: Potential for unauthorized access to sensitive information.
- Security Breach: Risk of compromising the overall security of the system.
- Privilege Escalation: Violation of the principle of least privilege.
- Violation of Access Control Policies: Contradiction with Teleport's documentation and policies.
- Risk of Insider Threats: Potential exploitation by malicious insiders.
updated the severity from critical to
medium (6.1)
. updated the severity from
medium (6.1)
to critical (9.0)
. ![Mike Jensen](data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="82" height="82"><rect fill-opacity="0"/></svg> "Mike Jensen"){kind=avatar}
changed the status to Triaged.
Thank you for the report @moaz219. I was able to reproduce this and agree with you that is a concerning privilege escalation in our new Access List functionality. I will let you know as soon as I have an update on this fix.
posted a comment.
Thank you so much for the reward! I'm glad I could assist.
if you have further feedback, please let me know.
Also, I would like to express that, based on the information provided in your policy's bonus section, I believe I am eligible for a bonus. It states that submitting a valid privilege escalation report is rewarded with a $1,000 bonus.
Thank you again !
posted a comment.
changed the status to Retesting.
@moaz219 This issue has been fixed for our cloud customers. Using your
teleport.sh tenant you should now be able to verify this fix.This issue will be communicated privately to customers today, but remains under embargo for public disclosure. I will request disclosure on HackerOne when we are ready to publicly disclose this issue.
If it helps as part of your retesting (or other testing), we found several additional cases that were addressed with this fix:
- Owners could add themselves to access lists, although list permissions were still respected this individual access expansion was not expected
- The
added_byusername andjoineddate field could be specified with arbitrary values - There was an additional privilege escalation case during the review process that was addressed
Let me know if you have any questions, or there is anything I can do to help. Thank you!
completed a retest.
Retest finding result
Are you able to reproduce the vulnerability report?
Please provide a short summary with the results of your retest
posted a comment.
Can we resolve this report ?
closed the report and changed the status to Resolved.
posted a comment.
Thank you for the additional validation @moaz219, resolved now. I will reach out and request disclosure after we publicly disclose this issue. Thank you!
requested to disclose this report.
@moaz219 Let me know if you have a GitHub handle you want us to list under the Credits for the GitHub Advisory on this issue. Thank you again for the help!
posted a comment.
Sure, you can list my GitHub handle as [Moaz219] for the Credits in the GitHub Advisory. Thank you!
posted a comment.
@moaz219 We have disclosed the vulnerability on GitHub here: https://github.com/gravitational/teleport/security/advisories/GHSA-76cc-p55w-63g3
Feel free to accept our disclosure request here on HackerOne when you get a chance. Thank you again for the help!
agreed to disclose this report.
This report has been disclosed.
Comments