Root Cause Analysis
The vulnerability is an improper authorization issue in DevGuard. Specifically, multiple API endpoints that perform write operations on 'public assets' did not have sufficient authorization checks. This allowed any user authenticated on the same DevGuard instance, regardless of their organization or project membership, to modify data associated with these public assets. This could lead to an integrity compromise of the vulnerability data, such as marking CVEs as false positives or deleting triage rules.
The patch addresses this by introducing a new middleware, DisallowPublicRequests, and by applying stricter Role-Based Access Control (RBAC) checks (assetScopedRBAC) to the affected routes. The DisallowPublicRequests middleware explicitly blocks write operations on public assets, while the assetScopedRBAC check ensures that the user has the appropriate permissions (e.g., ActionUpdate) for the operation.
The identified vulnerable functions are the handlers for these API endpoints. Before the patch, a malicious but authenticated user could invoke these functions on public assets they did not have explicit write access to. The functions themselves are not inherently flawed, but the routing layer failed to protect them adequately.
Vulnerable functions
controllers.ArtifactController.DeleteArtifactrouter/artifact_router.go
The route for this function was missing an authorization check (assetScopedRBAC) which allowed any authenticated user to delete an artifact on a public asset. The patch adds the necessary RBAC check.
controllers.ArtifactController.UpdateArtifactrouter/artifact_router.go
The route for this function was missing an authorization check (assetScopedRBAC) which allowed any authenticated user to update an artifact on a public asset. The patch adds the necessary RBAC check.
controllers.ArtifactController.Createrouter/asset_version_router.go
The route for this function was missing an authorization check (assetScopedRBAC) which allowed any authenticated user to create an artifact on a public asset. The patch adds the necessary RBAC check.
controllers.AssetVersionController.RefetchLicensesrouter/asset_version_router.go
The route for this function was missing an authorization check which allowed any authenticated user to trigger a license refresh on a public asset. The patch adds the `DisallowPublicRequests` middleware to prevent this.
controllers.DependencyVulnController.SyncDependencyVulnsrouter/dependency_vuln_router.go
The route for this function was missing an authorization check which allowed any authenticated user to sync dependency vulnerabilities on a public asset. The patch adds the `DisallowPublicRequests` middleware to prevent this.
controllers.DependencyVulnController.BatchCreateEventrouter/dependency_vuln_router.go
The route for this function was missing an authorization check which allowed any authenticated user to batch create vulnerability events on a public asset. The patch adds the `DisallowPublicRequests` middleware to prevent this.
controllers.DependencyVulnController.CreateEventrouter/dependency_vuln_router.go
The route for this function was missing an authorization check which allowed any authenticated user to create a vulnerability event on a public asset. The patch adds the `DisallowPublicRequests` middleware to prevent this.
controllers.DependencyVulnController.Mitigaterouter/dependency_vuln_router.go
The route for this function was missing an authorization check which allowed any authenticated user to mitigate a dependency vulnerability on a public asset. The patch adds the `DisallowPublicRequests` middleware to prevent this.
controllers.ExternalReferenceController.Createrouter/external_reference_router.go
The route for this function was missing an authorization check (assetScopedRBAC) which allowed any authenticated user to create an external reference on a public asset. The patch adds the necessary RBAC check.
controllers.ExternalReferenceController.Syncrouter/external_reference_router.go
The route for this function was missing an authorization check (assetScopedRBAC) which allowed any authenticated user to sync external references on a public asset. The patch adds the necessary RBAC check.
controllers.ExternalReferenceController.Deleterouter/external_reference_router.go
The route for this function was missing an authorization check (assetScopedRBAC) which allowed any authenticated user to delete an external reference on a public asset. The patch adds the necessary RBAC check.
controllers.FirstPartyVulnController.CreateEventrouter/first_party_vuln_router.go
The route for this function was missing an authorization check which allowed any authenticated user to create an event for a first-party vulnerability on a public asset. The patch adds the `DisallowPublicRequests` middleware to prevent this.
controllers.FirstPartyVulnController.Mitigaterouter/first_party_vuln_router.go
The route for this function was missing an authorization check which allowed any authenticated user to mitigate a first-party vulnerability on a public asset. The patch adds the `DisallowPublicRequests` middleware to prevent this.
controllers.LicenseRiskController.Createrouter/license_risk_router.go
The route for this function was missing an authorization check which allowed any authenticated user to create a license risk on a public asset. The patch adds the `DisallowPublicRequests` middleware to prevent this.
controllers.LicenseRiskController.CreateEventrouter/license_risk_router.go
The route for this function was missing an authorization check which allowed any authenticated user to create an event for a license risk on a public asset. The patch adds the `DisallowPublicRequests` middleware to prevent this.
controllers.LicenseRiskController.Mitigaterouter/license_risk_router.go
The route for this function was missing an authorization check which allowed any authenticated user to mitigate a license risk on a public asset. The patch adds the `DisallowPublicRequests` middleware to prevent this.
controllers.LicenseRiskController.MakeFinalLicenseDecisionrouter/license_risk_router.go
The route for this function was missing an authorization check which allowed any authenticated user to make a final license decision on a public asset. The patch adds the `DisallowPublicRequests` middleware to prevent this.
controllers.VEXRuleController.Createrouter/vex_rule_router.go
The route for this function was missing an authorization check which allowed any authenticated user to create a VEX rule on a public asset. The patch adds the `DisallowPublicRequests` middleware to prevent this.
controllers.VEXRuleController.Updaterouter/vex_rule_router.go
The route for this function was missing an authorization check which allowed any authenticated user to update a VEX rule on a public asset. The patch adds the `DisallowPublicRequests` middleware to prevent this.
controllers.VEXRuleController.Reapplyrouter/vex_rule_router.go
The route for this function was missing an authorization check which allowed any authenticated user to reapply a VEX rule on a public asset. The patch adds the `DisallowPublicRequests` middleware to prevent this.
controllers.VEXRuleController.Deleterouter/vex_rule_router.go
The route for this function was missing an authorization check which allowed any authenticated user to delete a VEX rule on a public asset. The patch adds the `DisallowPublicRequests` middleware to prevent this.
