empayre/fleet
14
0
Fork 0
mirror of https://github.com/empayre/fleet.git synced 2024-11-06 17:05:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
21269b1dd8
fleet/server/service
History
Zachary Wasserman 21269b1dd8 Prevent escalation of user privileges via ModifyUser method 
The ability to modify a users admin and enabled status was erroneously left in
place during development of https://github.com/kolide/fleet/pull/959. To
mitigate a privilege escalation vulnerability we need to ensure those values
can only be modified through the explicit methods.

This patch includes a unit test and fix for the vulnerability.

Thanks to 'Quikke' for submitting this vulnerability.
2018-09-18 14:56:25 -04:00
..
testdata add endpoint to serve the kolide certificate back to the user (#1025) 2017-01-20 14:32:10 -05:00
client_appconfig.go Add a setup guide for new CLI users (#1798) 2018-05-22 17:57:56 -06:00
client_errors.go Improve client error messages with unexpected server errors (#1776) 2018-05-09 16:54:23 -07:00
client_labels.go Improve client error messages with unexpected server errors (#1776) 2018-05-09 16:54:23 -07:00
client_live_query.go server/service, livequery: Check totals Load for nil (#1802) 2018-06-04 09:40:41 -06:00
client_options.go Add options clients and commands (#1791) 2018-05-21 10:25:58 -06:00
client_packs.go Improve client error messages with unexpected server errors (#1776) 2018-05-09 16:54:23 -07:00
client_queries.go Improve client error messages with unexpected server errors (#1776) 2018-05-09 16:54:23 -07:00
client_sessions.go Improve client error messages with unexpected server errors (#1776) 2018-05-09 16:54:23 -07:00
client_setup.go Improve client error messages with unexpected server errors (#1776) 2018-05-09 16:54:23 -07:00
client.go Add fleetctl query command (#1784) 2018-05-17 15:54:34 -07:00
endpoint_appconfig_test.go Allow update of settings page without enabling SMTP (#1903) 2018-09-07 15:37:35 -07:00
endpoint_appconfig.go Allow update of settings page without enabling SMTP (#1903) 2018-09-07 15:37:35 -07:00
endpoint_campaigns.go Add fleetctl query command (#1784) 2018-05-17 15:54:34 -07:00
endpoint_certificate.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
endpoint_change_email.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
endpoint_fim.go Added FIM support (#1548) 2017-08-18 10:37:33 -05:00
endpoint_hosts.go General simplification in go part (#1658) 2017-12-04 09:43:43 -05:00
endpoint_invites.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
endpoint_labels.go Fix deletion of labels in UI (#1848) 2018-06-25 13:56:59 -07:00
endpoint_middleware_test.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
endpoint_middleware.go Check if the jwtToken is valid in authViewer. (#1785) 2018-05-16 09:36:35 -06:00
endpoint_options_test.go Fix Issue where saving same option value errs. (#1433) 2017-03-30 17:03:48 -05:00
endpoint_options.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
endpoint_osquery_options.go Add endpoints for apply/get of each spec type (#1752) 2018-05-03 18:01:57 -07:00
endpoint_osquery.go Attempt 2 at returning a serializable config (#1819) 2018-06-11 11:34:05 -06:00
endpoint_packs.go Fix pack and query UI issues in Fleet 2.0 (#1829) 2018-06-15 10:13:11 -04:00
endpoint_queries.go Fix pack and query UI issues in Fleet 2.0 (#1829) 2018-06-15 10:13:11 -04:00
endpoint_scheduled_queries.go Fix bugs with packs created in UI (#1843) 2018-06-21 17:06:44 -07:00
endpoint_sessions.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
endpoint_setup.go ensure email and passwords are set during setup (#1786) 2018-05-17 08:29:04 -06:00
endpoint_targets.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
endpoint_test.go Pull decorators from config options (#1749) 2018-05-03 10:14:07 -07:00
endpoint_users_test.go Update go-kit to 0.4.0 (#1411) 2017-03-15 08:55:30 -07:00
endpoint_users.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
frontend.go General simplification in go part (#1658) 2017-12-04 09:43:43 -05:00
handler_test.go Fix pack and query UI issues in Fleet 2.0 (#1829) 2018-06-15 10:13:11 -04:00
handler.go Fix deletion of labels in UI (#1848) 2018-06-25 13:56:59 -07:00
http_auth_test.go General simplification in go part (#1658) 2017-12-04 09:43:43 -05:00
http_auth.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
logging_appconfig.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
logging_email_change.go Update go-kit to 0.4.0 (#1411) 2017-03-15 08:55:30 -07:00
logging_fim.go Added FIM support (#1548) 2017-08-18 10:37:33 -05:00
logging_hosts.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
logging_invites.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
logging_labels.go Fix labels UI issues in Fleet 2.0 (#1830) 2018-06-18 10:09:08 -07:00
logging_options.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
logging_osquery_options.go Add options clients and commands (#1791) 2018-05-21 10:25:58 -06:00
logging_osquery.go Merge branch 'master' into fleetctl 2018-05-01 17:26:32 -07:00
logging_packs.go Fix pack and query UI issues in Fleet 2.0 (#1829) 2018-06-15 10:13:11 -04:00
logging_queries.go Add logging middleware for spec endpoints (#1774) 2018-05-09 11:00:48 -07:00
logging_scheduled_queries.go Fix pack and query UI issues in Fleet 2.0 (#1829) 2018-06-15 10:13:11 -04:00
logging_sessions.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
logging_users.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
logging.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
metrics_appconfig.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
metrics_change_email.go Update go-kit to 0.4.0 (#1411) 2017-03-15 08:55:30 -07:00
metrics_fim.go Added FIM support (#1548) 2017-08-18 10:37:33 -05:00
metrics_invites.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
metrics_labels.go Fix labels UI issues in Fleet 2.0 (#1830) 2018-06-18 10:09:08 -07:00
metrics_options.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
metrics_sessions.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
metrics_users.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
metrics.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
service_appconfig_test.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
service_appconfig.go Allow update of settings page without enabling SMTP (#1903) 2018-09-07 15:37:35 -07:00
service_campaigns.go Add fleetctl query command (#1784) 2018-05-17 15:54:34 -07:00
service_certificate_test.go add endpoint to serve the kolide certificate back to the user (#1025) 2017-01-20 14:32:10 -05:00
service_certificate.go Update go-kit to 0.4.0 (#1411) 2017-03-15 08:55:30 -07:00
service_errors.go removing license code (#1551) 2017-09-01 10:42:46 -06:00
service_fim_test.go server: formatting (#1788) 2018-05-16 23:52:24 -06:00
service_fim.go server: formatting (#1788) 2018-05-16 23:52:24 -06:00
service_hosts_test.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
service_hosts.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
service_invites_test.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
service_invites.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
service_labels_test.go Delete spec entities by name instead of ID (#1755) 2018-05-04 11:05:55 -07:00
service_labels.go Fix deletion of labels in UI (#1848) 2018-06-25 13:56:59 -07:00
service_options.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
service_osquery_options.go Add endpoints for apply/get of each spec type (#1752) 2018-05-03 18:01:57 -07:00
service_osquery_test.go Pull decorators from config options (#1749) 2018-05-03 10:14:07 -07:00
service_osquery.go Pull decorators from config options (#1749) 2018-05-03 10:14:07 -07:00
service_packs_test.go Delete spec entities by name instead of ID (#1755) 2018-05-04 11:05:55 -07:00
service_packs.go Fix pack and query UI issues in Fleet 2.0 (#1829) 2018-06-15 10:13:11 -04:00
service_queries_test.go Delete spec entities by name instead of ID (#1755) 2018-05-04 11:05:55 -07:00
service_queries.go Fix pack and query UI issues in Fleet 2.0 (#1829) 2018-06-15 10:13:11 -04:00
service_scheduled_queries.go Fix bugs with packs created in UI (#1843) 2018-06-21 17:06:44 -07:00
service_sessions_test.go Fix documentation typos (#1682) 2017-12-21 18:37:32 -08:00
service_sessions.go Fixed leaking http client (#1628) 2017-11-16 09:53:42 -07:00
service_targets_test.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
service_targets.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
service_test.go Changed default osquery logging behavior 2017-04-03 16:48:50 -05:00
service_users_test.go Prevent escalation of user privileges via ModifyUser method 2018-09-18 14:56:25 -04:00
service_users.go Prevent escalation of user privileges via ModifyUser method 2018-09-18 14:56:25 -04:00
service.go Fixed leaking http client (#1628) 2017-11-16 09:53:42 -07:00
transport_appconfig.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
transport_campaigns.go Add fleetctl query command (#1784) 2018-05-17 15:54:34 -07:00
transport_change_email.go Update go-kit to 0.4.0 (#1411) 2017-03-15 08:55:30 -07:00
transport_error.go Fix pack and query UI issues in Fleet 2.0 (#1829) 2018-06-15 10:13:11 -04:00
transport_fim.go Added FIM support (#1548) 2017-08-18 10:37:33 -05:00
transport_hosts.go Update go-kit to 0.4.0 (#1411) 2017-03-15 08:55:30 -07:00
transport_invites_test.go Update go-kit to 0.4.0 (#1411) 2017-03-15 08:55:30 -07:00
transport_invites.go Update go-kit to 0.4.0 (#1411) 2017-03-15 08:55:30 -07:00
transport_labels_test.go Fix labels UI issues in Fleet 2.0 (#1830) 2018-06-18 10:09:08 -07:00
transport_labels.go Fix deletion of labels in UI (#1848) 2018-06-25 13:56:59 -07:00
transport_options.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
transport_osquery_options.go Add endpoints for apply/get of each spec type (#1752) 2018-05-03 18:01:57 -07:00
transport_osquery_test.go Fix distributed query status parsing for osquery 3 (#1742) 2018-04-24 12:40:11 -07:00
transport_osquery.go Fix distributed query status parsing for osquery 3 (#1742) 2018-04-24 12:40:11 -07:00
transport_packs_test.go Fix pack and query UI issues in Fleet 2.0 (#1829) 2018-06-15 10:13:11 -04:00
transport_packs.go Fix pack and query UI issues in Fleet 2.0 (#1829) 2018-06-15 10:13:11 -04:00
transport_queries_test.go Delete spec entities by name instead of ID (#1755) 2018-05-04 11:05:55 -07:00
transport_queries.go Fix pack and query UI issues in Fleet 2.0 (#1829) 2018-06-15 10:13:11 -04:00
transport_scheduled_queries_test.go Fix pack and query UI issues in Fleet 2.0 (#1829) 2018-06-15 10:13:11 -04:00
transport_scheduled_queries.go Fix pack and query UI issues in Fleet 2.0 (#1829) 2018-06-15 10:13:11 -04:00
transport_sessions_test.go Update go-kit to 0.4.0 (#1411) 2017-03-15 08:55:30 -07:00
transport_sessions.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
transport_setup.go Update go-kit to 0.4.0 (#1411) 2017-03-15 08:55:30 -07:00
transport_targets_test.go Update go-kit to 0.4.0 (#1411) 2017-03-15 08:55:30 -07:00
transport_targets.go Update go-kit to 0.4.0 (#1411) 2017-03-15 08:55:30 -07:00
transport_test.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
transport_users_test.go Update go-kit to 0.4.0 (#1411) 2017-03-15 08:55:30 -07:00
transport_users.go Update go-kit to 0.4.0 (#1411) 2017-03-15 08:55:30 -07:00
transport.go Implement Get methods for single entities of label, pack and query specs (#1766) 2018-05-07 19:54:29 -06:00
util_test.go removing license code (#1551) 2017-09-01 10:42:46 -06:00
validation_app_config_test.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
validation_app_config.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
validation_invites.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
validation_options.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
validation_sessions.go Rename project to Kolide Fleet (#1529) 2017-06-22 15:50:45 -04:00
validation_setup.go Add fleetctl config and auth commands (#1751) 2018-05-04 10:53:21 -06:00
validation_users.go General simplification in go part (#1658) 2017-12-04 09:43:43 -05:00