[ZBX-7981] "Exists" API methods ignore permissions Created: 2014 Mar 21  Updated: 2020 Jul 16  Due: 2014 Apr 30  Resolved: 2014 May 06

Status: Closed
Project: ZABBIX BUGS AND ISSUES
Component/s: API (A), Frontend (F)
Affects Version/s: 1.8.20, 2.0.11rc2, 2.2.3rc1, 2.3.0
Fix Version/s: 2.3.0

Type: Defect (Security) Priority: Major
Reporter: Pavels Jelisejevs (Inactive) Assignee: Ivo Kurzemnieks
Resolution: Fixed Votes: 0
Labels: api, security
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified


 Description   

The "exists" methods, which allow to check whether an object matching some criteria, exists does not check permissions. For example, we can find out, if host "Zabbix server" exists, even if we don't have permissions to it. This vulnerability is not that critical, since there are other ways we can find this out: we can try to create a host with the same name, and see if an error is triggered. But in the case with "exists" methods, we have some additional uses: for example, check if an item with a specific key exists on a host we have no permissions to.



 Comments   
Comment by Pavels Jelisejevs (Inactive) [ 2014 Mar 21 ]

These methods will be deprecated in 2.4 and removed in 2.6. Get methods can be used as an alternative.

The issue will be fixed the supported stable releases.

Comment by Ivo Kurzemnieks [ 2014 Apr 11 ]

RESOLVED for 1.8 in svn://svn.zabbix.com/branches/dev/ZBX-7981

Comment by Pavels Jelisejevs (Inactive) [ 2014 Apr 16 ]

After some internal discussions we've decided to fix this issue only in 2.4. Fixing it in all releases requires too much work.

Comment by Ivo Kurzemnieks [ 2014 Apr 17 ]

(1) Found a related issue when performing host.massupdate and passing one host trying to rename it to an existing template, validation worked
incorrectly. It selected all hosts and always returned error. Same problem was later found in template.massupdate when renaming template to existing host name. We discussed this a bit and decided to fix it here.

iivs RESOLVED in svn://svn.zabbix.com/branches/dev/ZBX-7981-trunk r44582
Eduards CLOSED

Comment by Ivo Kurzemnieks [ 2014 Apr 23 ]

(2)
Translatable strings removed:
'No permission for trigger "%s"'
'No permissions for group "%1$s".'
'already exists'
'Discovery rule "%s" already exists.'
'Maintenance "%s" already exists.'

Translatable strings added:
'No permission for trigger "%1$s"'
'No permissions for host group "%1$s".'
'User group "%1$s" already exists.'
'Discovery rule "%1$s" already exists.'
'Maintenance "%1$s" already exists.'

Eduards CLOSED

Comment by Ivo Kurzemnieks [ 2014 Apr 23 ]

RESOLVED for 2.3.0 (trunk) svn://svn.zabbix.com/branches/dev/ZBX-7981-trunk r44696

Comment by Eduards Samersovs (Inactive) [ 2014 Apr 24 ]

(3) We can optimize new query in CDRule.create to get all used names for unique validation at once. Same for update.

iivs drule.create and drule.update has been improved. RESOLVED in r44771
Found a related problem: Passing same name twice in API, resulted in SQL error. RESOLVED in r44849, r44872
Existing ID validation was never found: RESOLVED in r44854

Eduards REOPEN,

  • CDRule.php:409,501 in this query will be good to use limit 1
  • Undefined index if try to clone discovery rule with same name:
    Undefined index: druleid [discoveryconf.php:141 → CFrontendApiWrapper->create() → CApiWrapper->__call() → CFrontendApiWrapper->callMethod() → CApiWrapper->callMethod() → CFrontendApiWrapper->callClientMethod() → CLocalApiClient->callMethod() → call_user_func_array() → CDRule->create() → CApiService->checkValidator() → CCollectionValidator->validate() → CArrayHelper::findDuplicate() in /home/zabbix/www/testing-ZBX-7981-trunk/frontends/php/include/classes/helpers/CArrayHelper.php:207]

iivs RESOLVED in r44913 (drule.update changes r44917)

Eduards REOPEN in CDRule.php:490 You create array with unique names and after validate for duplicates

iivs Array did not contain unique names. After discussion we decided to slighty refactor the code there. RESOLVED in r44952, 44953

Eduards CLOSED

Comment by Eduards Samersovs (Inactive) [ 2014 Apr 24 ]

(4) Same optimization also can be done in Graph validation. Also seems in CGraph.php:394 we don't need to make zbx_strtolower() because we can save graphs with name "a" and "A". Also please keep empty line before "if.." in CGraph.php:393, it's hard to read code without "delimiters".

Same in GraphPrototype

iivs Agree, it would be good to optimize it, but for graphs it's more complacated and because we're now moving away from original issue, optimization will be done in separate issue. However, indeed, there was a bug when comparing case insensitive names. This has been RESOLVED in r44874

Eduards REOPEN, Ok, so change comparison to strict in CGraph.php:394 and CGraphPrototype.php:406

iivs Yes, sorry, I forgot. RESOLVED in r44914

Eduards CLOSED

Comment by Eduards Samersovs (Inactive) [ 2014 Apr 24 ]

(5) Same optimization can be done in CHostGroups.create(), CImage.create(), CMaintenance.create(), CTemplate.validateCreate(), CUserGroup.create(). Same also in multiple places in XML import.

Other improvements will be moved to separate issue in the near future.

I made some improvements in following APIs:

  • Images RESOLVED in r44871
    Eduards REOPEN
  • CImage.php:506,565 in this query will be good to use limit 1
  • Undefined index: imageid [adm.images.php:93 → CFrontendApiWrapper->create() → CApiWrapper->__call() → CFrontendApiWrapper->callMethod() → CApiWrapper->callMethod() → CFrontendApiWrapper->callClientMethod() → CLocalApiClient->callMethod() → call_user_func_array() → CImage->create() → CImage->validateCreate() → CApiService->checkValidator() → CCollectionValidator->validate() → CArrayHelper::findDuplicate() in /home/zabbix/www/testing-ZBX-7981-trunk/frontends/php/include/classes/helpers/CArrayHelper.php:207]
  • code CImage.php:570-580 can be optimized same way as in CDRule
    iivs RESOLVED in r44918
    Eduards REOPEN in CImages.php:553 You create array with unique names and after validate for duplicates
    iivs RESOLVED in r44954
    Eduards REOPEN Typo in variable name "$imageNamesChaged"
    iivs RESOLVED in r44957
    Eduards CLOSED
  • Host groups RESOLVED in r44850
    Eduards REOPEN
  • CHostGroups.php:440 in this query will be good to use limit 1
  • Undefined index: groupid [hostgroups.php:129 → CFrontendApiWrapper->create() → CApiWrapper->__call() → CFrontendApiWrapper->callMethod() → CApiWrapper->callMethod() → CFrontendApiWrapper->callClientMethod() → CLocalApiClient->callMethod() → call_user_func_array() → CHostGroup->create() → CApiService->checkValidator() → CCollectionValidator->validate() → CArrayHelper::findDuplicate() in /home/zabbix/www/testing-ZBX-7981-trunk/frontends/php/include/classes/helpers/CArrayHelper.php:207]
    iivs RESOLVED in r44919
    Eduards CLOSED
  • Maintenances RESOLVED in r44873
    Eduards REOPEN. I don't have any maintenance. Try to create new and get the error:
    Undefined index: maintenanceid [maintenance.php:199 → CFrontendApiWrapper->create() → CApiWrapper->__call() → CFrontendApiWrapper->callMethod() → CApiWrapper->callMethod() → CFrontendApiWrapper->callClientMethod() → CLocalApiClient->callMethod() → call_user_func_array() → CMaintenance->create() → CApiService->checkValidator() → CCollectionValidator->validate() → CArrayHelper::findDuplicate() in /home/zabbix/www/testing-ZBX-7981-trunk/frontends/php/include/classes/helpers/CArrayHelper.php:207]
    Maintenance "1" already exists.

Also code CMaintenance.php:500-507 can be optimized
iivs RESOLVED in r44918

  • Maintenances: Undefined index is now fixed, but I couldn't reproduce this problem with no maintenances. Optimization RESOLVED in r44920

Eduards REOPEN

  • CMaintenance.php:479 You create array with unique names and after validate for duplicates
  • Cannot create maintenance on clean db.

iivs Cannot reproduce last problem. I tried also with fresh install. Refactoring (as discussed) RESOLVED in r44954
Eduards CLOSED This bug is reported in ZBX-8165

-----------------

Eduards CLOSED

Comment by Eduards Samersovs (Inactive) [ 2014 Apr 24 ]

(6) CTemplate.php:994,1009,1031,1046 - limit=1 is not needed because in db can be only one template with the given name.

iivs RESOLVED in r44819
Eduards CLOSED

Comment by Eduards Samersovs (Inactive) [ 2014 Apr 29 ]

Tested

Comment by Ivo Kurzemnieks [ 2014 Apr 29 ]
  • API "exists" methods are now deprecated;
  • Additionally fixed validation when renaming host to an existing template host.massupdate method and when renaming template to an existing host template.massupdate method;
  • optimized several API create and updated methods to query existing names all at once instead of each iteration. Further API create and update improvements moved to ZBXNEXT-2285

Implemented and fixed in pre-2.3.0 (trunk) r44991

Comment by richlv [ 2014 Apr 29 ]

(7) one of the changelog entries does not follow the guidelines

> grep ZBX-7981 ChangeLog
A......... ZBX-7981 API "exists" methods are now deprecated (Ivo)
A......... ZBX-7981 fixed validation when renaming host to an existing template in host.massupdate; fixed validation when renaming template to an existing host in template.massupdate (Ivo)

from the guidelines :

All entries should start with a lower case letter and in the past form

iivs RESOLVED in r45008

<richlv> looking great, thanks -> CLOSED

Comment by richlv [ 2014 Apr 29 ]

(8) the comment says "optimized several API create and updated methods to query existing names all at once instead of each iteration" - thanks for mentioning it, but could you please list all methods that have been optimised ?
also, i assume that these optimisations were only applied to trunk - is that correct ?

iivs
drule.create
drule.update
hostgroup.create
image.create
image.update
maintenance.create
maintenance.update

Yes, trunk only (fixed versions says so).

<richlv> thanks, CLOSED

Comment by Pavels Jelisejevs (Inactive) [ 2014 May 06 ]

(9) The CApiService::deprecated() method must not be called statically.

iivs RESOLVED in svn://svn.zabbix.com/branches/dev/ZBX-7981 r45090

jelisejev CLOSED.

Comment by Pavels Jelisejevs (Inactive) [ 2014 May 06 ]

(10) Updated the API docs:

iivs REVIEWED. Looks good.
CLOSED.

Comment by Pavels Jelisejevs (Inactive) [ 2014 May 07 ]

TESTED.

Comment by Ivo Kurzemnieks [ 2014 May 07 ]

Deprecated "exists" methods corrected to non-static.

Fixed in pre-2.3.0 (trunk) r45138

Generated at Fri Apr 19 09:38:55 EEST 2024 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.