Some refactoring, optimizations and security fixes #5291
Conversation
- Refactored several code to use more modern syntax - Made some checks a bit more strict - Updated crates Signed-off-by: BlackDex <[email protected]>
BlackDex
changed the title
|
@dani-garcia @BlackDex This should be submitted as a CVE. https://github.com/dani-garcia/vaultwarden/security/advisories/new It's basically a priv escalation, among other CWE's that apply like:
|
|
I'm not sure if we really should report a CVE to be honest. It will probably take a long time for it to be requested and granted, since for one i have never done that my self before, and what i hear is that it is a long process. |
|
@BlackDex With GitHub it takes 1-2 days. You do it through that URL I posted above. GitHub will handle adding the entry to the registries, assigning a cve #, etc. |
|
Ok. fine by me |
|
For future reference, the advisory lives here, but it's private at the moment while waiting for Github to assign it a CVE: I'll update here again once that process is done and the CVE is public. |
|
Well that didn't take long at all, advisory and CVE are public at GHSA-g65h-982x-4m5m |
|
@dani-garcia Thank you 💪 |
We also fixed a security issue with groups. Admins from any organization were able to modify or delete groups in any other organization if they know the group's uuid. The organization uuid was not used in the query or validated with the group. This is now fixed including some other parts where i changed the checks to be more strict.