yarn-server CVE-2021-3562: Missing Privilege Checks & Fix Details

Vulnerability Overview Vulnerability Type: Missing Privilege Checks Commit Message: Committer: hgb / artemch Commit Date: 2021-07-12 Related Branch: Affected Files: A total of 5 files were modified, involving the privilege validation logic of -related modules. Impact Scope Affected Modules: - core service ( ) - Involves API interfaces such as , , and Affected Methods: - series of methods (used to validate parameter-level privileges) - Methods in such as , , , , , - Methods in such as , , , Risk: Insufficient privilege validation at critical API entry points, which may lead to unauthorized access or privilege escalation. Fix Solution Core Fix: Added calls in multiple API methods to ensure every request undergoes privilege validation. Specific Changes: - In , the method was newly added/modified to support privilege checks on and types. - In , calls were added to methods such as , , , , , and . - In , privilege check logic was added to methods such as , , , and , and the constant was introduced to control the access policy. Code Example (POC/Fix Code Snippet): ```java // Privilege check method newly added in Context.java public void checkParameterPrivilege(ObjectPrivilegeType type, Collection objects) throws ForbiddenException { for (Parameter parameter : objects) { if (user.hasObjectPrivilege(type, parameter)) { throw new ForbiddenException("User " + type + " authorization for " + parameter.getDisplayName() + " is missing."); } } } // Fix example in CopilotApi.java @Override public void initialize(Context ctx, InitializeRequest request, Observer observer) { ctx.checkParameterPrivilege(SystemPrivilege.ControlLinks); CopilotApiHandler.handle(ctx, request, observer); } // Fix example in IndexApi.java @Override public void listCommits(Context ctx, ListCommitsRequest request, Observer observer) { var privilegeCheck = new MapHashMap(); indexRequest.setCommits(request.getCommits()); if (request.getNumber() != null) { indexRequest.setNumber(request.getNumber()); } if (request.getSince() != null) { indexRequest.setSince(request.getSince()); } if (request.getUntil() != null) { indexRequest.setUntil(request.getUntil()); } indexRequest.setPerPage(request.getPerPage()); indexRequest.setPage(request.getPage()); indexRequest.setSort(request.getSort()); indexRequest.setOrder(request.getOrder()); indexRequest.setQ(request.getQ()); indexRequest.setRepo(request.getRepo()); indexRequest.setBranch(request.getBranch()); indexRequest.setAuthor(request.getAuthor()); indexRequest.setSince(request.getSince()); indexRequest.setUntil(request.getUntil()); indexRequest.setPerPage(request.getPerPage()); indexRequest.setPage(request.getPage()); indexRequest.setSort(request.getSort()); indexRequest.setOrder(request.getOrder()); indexRequest.setQ(request.getQ()); indexRequest.setRepo(request.getRepo()); indexRequest.setBranch(request.getBranch()); indexRequest.setAuthor(request.getAuthor()); indexRequest.setSince(request.getSince()); indexRequest.setUntil(request.getUntil()); indexRequest.setPerPage(request.getPerPage()); indexRequest.setPage(request.getPage()); indexRequest.setSort(request.getSort()); indexRequest.setOrder(request.getOrder()); indexRequest.setQ(request.getQ()); indexRequest.setRepo(request.getRepo()); indexRequest.setBranch(request.getBranch()); indexRequest.setAuthor(request.getAuthor()); indexRequest.setSince(request.getSince()); indexRequest.setUntil(request.getUntil()); indexRequest.setPerPage(request.getPerPage()); indexRequest.setPage(request.getPage()); indexRequest.setSort(request.getSort()); indexRequest.setOrder(request.getOrder()); indexRequest.setQ(request.getQ()); indexRequest.setRepo(request.getRepo()); indexRequest.setBranch(request.getBranch()); indexRequest.setAuthor(request.getAuthor()); indexRequest.setSince(request.getSince()); indexRequest.setUntil(request.getUntil()); indexRequest.setPerPage(request.getPerPage()); indexRequest.setPage(request.getPage()); indexRequest.setSort(request.getSort()); indexRequest.setOrder(request.getOrder()); indexRequest.setQ(request.getQ()); indexRequest.setRepo(request.getRepo()); indexRequest.setBranch(request.getBranch()); indexRequest.setAuthor(request.getAuthor()); indexRequest.setSince(request.getSince()); indexRequest.setUntil(request.getUntil()); indexRequest.setPerPage(request.getPerPage()); indexRequest.setPage(request.getPage()); indexRequest.setSort(request.getSort()); indexRequest.setOrder(request.getOrder()); indexRequest.setQ(request.getQ()); indexRequest.setRepo(request.getRepo()); indexRequest.setBranch(request.getBranch()); indexRequest.setAuthor(request.getAuthor()); indexRequest.setSince(request.getSince()); indexRequest.setUntil(request.getUntil()); indexRequest.setPerPage(request.getPerPage()); indexRequest.setPage(request.getPage()); indexRequest.setSort(request.getSort()); indexRequest.setOrder(request.getOrder()); indexRequest.setQ(request.getQ()); indexRequest.setRepo(request.getRepo()); indexRequest.setBranch(request.getBranch()); indexRequest.set

Goal Reached Thanks to every supporter — we hit 100%!

yarn-server CVE-2021-3562: Missing Privilege Checks & Fix Details

More from this source