Open Build Service arbitrary package modification

Vulnerability

The InitializeDevelPackage function in openSUSE Open Build Service (OBS) before version 2.9.3 lacked proper permission checks. This allowed authenticated users to modify packages for which they did not have write permissions. The issue is present in the OBS API and webui components. [1][2]

Exploitation

An attacker needs to be an authenticated user of the OBS instance. By exploiting the missing permission check in InitializeDevelPackage, the attacker could submit requests to modify packages without having the required maintainer role on the source package. The commit shows that the fix adds permission checks for the source package when the InitializeDevelPackage attribute is set on the project. [2]

Impact

Successful exploitation allows an authenticated attacker to modify packages they should not have write access to, potentially leading to unauthorized changes to package content, metadata, or dependencies. This could compromise the integrity of the build service and affect downstream users.

Mitigation

The vulnerability is fixed in openSUSE Open Build Service version 2.9.3. The fix was implemented in commit 990ef7cccef6f38fc1d1a1bb22a08e174dcba43b. Users should upgrade to version 2.9.3 or later. No workarounds are mentioned in the references. [1][2]