Pulpcore: rbac permissions incorrectly assigned in tasks that create objects

Vulnerability

Description A flaw in the Pulp package's role-based access control (RBAC) implementation causes incorrect assignment of object permissions during task execution. The AutoAddObjPermsMixin mixin, specifically the add_roles_for_object_creator method, determines the object creator by checking the current authenticated user context. However, for objects created within a task, this context is set to the first user who has any permissions on the task object, which is typically the oldest user with model/domain-level task permissions, rather than the user who actually dispatched the task. [1][2]

Exploitation

An attacker who is an older user with task permissions within the Pulp system can exploit this by having their permissions context carry over to tasks they did not initiate. As a result, any objects created in those tasks will have their permissions granted to the oldest user with task permissions, not the user who triggered the task. This attack requires that the attacker already has some model/domain-level task permissions, but they do not need to have dispatched the task themselves. [3]

Impact

Successful exploitation leads to privilege escalation where an attacker granted permissions to objects they did not create. The legitimate creating user receives no permissions on the objects they created, potentially locking them out of their own work. This undermines the RBAC model and can lead to unauthorized access or denial of service for legitimate users. [4]

Mitigation

Red Hat has released an advisory (RHSA-2024:6765) with patches to address this vulnerability. Users should update their Pulp installations to the latest version that corrects the permission assignment logic. No workarounds have been publicly documented. The vulnerability affects Pulp packages; checking the advisory for specific version fixes is recommended. [1]