{"action":"created","issue":{"url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/5509","repository_url":"https://api.github.com/repos/jhipster/generator-jhipster","labels_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/5509/labels{/name}","comments_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/5509/comments","events_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/5509/events","html_url":"https://github.com/jhipster/generator-jhipster/issues/5509","id":217827183,"node_id":"MDU6SXNzdWUyMTc4MjcxODM=","number":5509,"title":"Elevation of privileges","user":{"login":"saponace","id":11739014,"node_id":"MDQ6VXNlcjExNzM5MDE0","avatar_url":"https://avatars1.githubusercontent.com/u/11739014?v=4","gravatar_id":"","url":"https://api.github.com/users/saponace","html_url":"https://github.com/saponace","followers_url":"https://api.github.com/users/saponace/followers","following_url":"https://api.github.com/users/saponace/following{/other_user}","gists_url":"https://api.github.com/users/saponace/gists{/gist_id}","starred_url":"https://api.github.com/users/saponace/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/saponace/subscriptions","organizations_url":"https://api.github.com/users/saponace/orgs","repos_url":"https://api.github.com/users/saponace/repos","events_url":"https://api.github.com/users/saponace/events{/privacy}","received_events_url":"https://api.github.com/users/saponace/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/jhipster/generator-jhipster/milestones/106","html_url":"https://github.com/jhipster/generator-jhipster/milestone/106","labels_url":"https://api.github.com/repos/jhipster/generator-jhipster/milestones/106/labels","id":2432956,"node_id":"MDk6TWlsZXN0b25lMjQzMjk1Ng==","number":106,"title":"4.2.0","description":"","creator":{"login":"jdubois","id":316835,"node_id":"MDQ6VXNlcjMxNjgzNQ==","avatar_url":"https://avatars1.githubusercontent.com/u/316835?v=4","gravatar_id":"","url":"https://api.github.com/users/jdubois","html_url":"https://github.com/jdubois","followers_url":"https://api.github.com/users/jdubois/followers","following_url":"https://api.github.com/users/jdubois/following{/other_user}","gists_url":"https://api.github.com/users/jdubois/gists{/gist_id}","starred_url":"https://api.github.com/users/jdubois/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jdubois/subscriptions","organizations_url":"https://api.github.com/users/jdubois/orgs","repos_url":"https://api.github.com/users/jdubois/repos","events_url":"https://api.github.com/users/jdubois/events{/privacy}","received_events_url":"https://api.github.com/users/jdubois/received_events","type":"User","site_admin":false},"open_issues":0,"closed_issues":76,"state":"closed","created_at":"2017-04-04T08:27:21Z","updated_at":"2017-04-11T19:11:24Z","due_on":null,"closed_at":"2017-04-11T19:11:24Z"},"comments":5,"created_at":"2017-03-29T10:09:32Z","updated_at":"2018-09-11T14:35:39Z","closed_at":"2017-03-29T11:06:49Z","author_association":"NONE","body":"### **Overview of the issue**\r\n\r\nAny user that can log into the application can elevate its privileges to admin by adding a value to a JSON array when retrieving the response of the server to the authentication requests.\r\n\r\n##### **Motivation for or Use Case**\r\n\r\nThis is a security breach\r\n\r\n### **Reproduce the error**\r\n\r\n- Go to the application home\r\n- Open javascript console\r\n- Place a breakpoint on the file /app/services/auth/principal.service.js on line 79 (line of code: `_identity = account.data;`, in the function getAccountThen(account), in the function identity(force))\r\n- Log in with the default user credentials: login: `user` pwd: `user`\r\n- The execution will stop when reaching this given line\r\n- Look at the value of `account.data` : it is an array with one element : 'ROLE_USER'\r\n- Add a second element to this array: 'ROLE_ADMIN'\r\n- `accoun.data` now has two elements: 'ROLE_USER' and 'ROLE_ADMIN'\r\n- Carry on with the execution\r\n- The user is now logged in with administrator privileges (access to metrics, Swagger API, etc.)\r\n\r\n### **Related issues**\r\n\r\nI did not see any related issue.\r\n\r\n### **Suggest a Fix**\r\n\r\nI have no idea how to fix that breach. It seems like fixing it would imply changing a big part of the authorization mechanism (notably: the backend should not accept requests that do not contain a proff of who sent the request). Sorry for the useless suggestion, I do not know anything about authentification :)\r\n\r\n### **JHipster Version(s)**\r\n```\r\ngenerator-jhipster@3.7.0  invalid\r\n\r\n```\r\n\r\n### **JHipster configuration**\r\n```yaml\r\n{\r\n  \"generator-jhipster\": {\r\n    \"jhipsterVersion\": \"3.12.2\",\r\n    \"baseName\": \"xxxxxxx\",\r\n    \"packageName\": \"org.xxxxxx.xxxxxx\",\r\n    \"packageFolder\": \"org/xxxxxx/xxxxxx\",\r\n    \"serverPort\": \"8080\",\r\n    \"authenticationType\": \"session\",\r\n    \"hibernateCache\": \"ehcache\",\r\n    \"clusteredHttpSession\": false,\r\n    \"websocket\": \"spring-websocket\",\r\n    \"databaseType\": \"sql\",\r\n    \"devDatabaseType\": \"h2Disk\",\r\n    \"prodDatabaseType\": \"postgresql\",\r\n    \"searchEngine\": \"elasticsearch\",\r\n    \"buildTool\": \"maven\",\r\n    \"enableSocialSignIn\": false,\r\n    \"rememberMeKey\": \"xxxxxx\",\r\n    \"useSass\": false,\r\n    \"applicationType\": \"monolith\",\r\n    \"testFrameworks\": [\r\n      \"gatling\",\r\n      \"protractor\"\r\n    ],\r\n    \"jhiPrefix\": \"jhi\",\r\n    \"enableTranslation\": false,\r\n    \"messageBroker\": false,\r\n    \"serviceDiscoveryType\": false\r\n  }\r\n}\r\n```\r\n\r\n### **Entity configuration(s) `entityName.json` files generated in the `.jhipster` directory**\r\n\r\nI can't really share the entityName.json publicly. But I can assure that none of the created entites are the cause of this issue.\r\n\r\n### **Browsers and Operating System**\r\n\r\nWindows 7, Chrome  56.0.2924.87\r\n\r\n- [x ] Checking this box is mandatory (this is just to show you read everything)\r\n\r\n\r\nI hope this issue will help !"},"comment":{"url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/comments/420296494","html_url":"https://github.com/jhipster/generator-jhipster/issues/5509#issuecomment-420296494","issue_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/5509","id":420296494,"node_id":"MDEyOklzc3VlQ29tbWVudDQyMDI5NjQ5NA==","user":{"login":"yatendragoel","id":1221759,"node_id":"MDQ6VXNlcjEyMjE3NTk=","avatar_url":"https://avatars2.githubusercontent.com/u/1221759?v=4","gravatar_id":"","url":"https://api.github.com/users/yatendragoel","html_url":"https://github.com/yatendragoel","followers_url":"https://api.github.com/users/yatendragoel/followers","following_url":"https://api.github.com/users/yatendragoel/following{/other_user}","gists_url":"https://api.github.com/users/yatendragoel/gists{/gist_id}","starred_url":"https://api.github.com/users/yatendragoel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yatendragoel/subscriptions","organizations_url":"https://api.github.com/users/yatendragoel/orgs","repos_url":"https://api.github.com/users/yatendragoel/repos","events_url":"https://api.github.com/users/yatendragoel/events{/privacy}","received_events_url":"https://api.github.com/users/yatendragoel/received_events","type":"User","site_admin":false},"created_at":"2018-09-11T14:35:39Z","updated_at":"2018-09-11T14:35:39Z","author_association":"NONE","body":"@PierreBesson I think even `getAllUsers()` and `getUser(login)` must also have `@Secured(ADMIN)` **by default** because the security has to be most restrictive by default and not less restrictive. If anyone has a requirement of something like *one user seeing other users*, then he can always make these two methods less secure."}}
{"actor":{"display_login":"yatendragoel"}}