All users were able to request organizational details from any org, even if they were not a member (anymore). Now it will check if that user is a member of the org or not.
The /organization/<uuid>/keys endpoint returned also the private keys. This should not be the case. Also, according to the upstream server code the endpoint changed, but the clients do not seem to use it. I added it anyway just in case they will in the future.
Also require a valid login before being able to retreve those org keys. Upstream does not do this, but i see no reason why not.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/dani-garcia/vaultwarden/pull/4837
**Author:** [@BlackDex](https://github.com/BlackDex)
**Created:** 8/11/2024
**Status:** ✅ Merged
**Merged:** 8/11/2024
**Merged by:** [@dani-garcia](https://github.com/dani-garcia)
**Base:** `main` ← **Head:** `org-fixes`
---
### 📝 Commits (1)
- [`44f88cc`](https://github.com/dani-garcia/vaultwarden/commit/44f88ccb776b43da7b9d27e31dd536646f750675) Fix data disclosure on organization endpoints
### 📊 Changes
**2 files changed** (+37 additions, -7 deletions)
<details>
<summary>View changed files</summary>
📝 `src/api/core/organizations.rs` (+24 -7)
📝 `src/db/models/organization.rs` (+13 -0)
</details>
### 📄 Description
- All users were able to request organizational details from any org, even if they were not a member (anymore). Now it will check if that user is a member of the org or not.
- The `/organization/<uuid>/keys` endpoint returned also the private keys. This should not be the case. Also, according to the upstream server code the endpoint changed, but the clients do not seem to use it. I added it anyway just in case they will in the future.
- Also require a valid login before being able to retreve those org keys. Upstream does not do this, but i see no reason why not.
Fixes: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39925
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/dani-garcia/vaultwarden/pull/4837
Author: @BlackDex
Created: 8/11/2024
Status: ✅ Merged
Merged: 8/11/2024
Merged by: @dani-garcia
Base:
main← Head:org-fixes📝 Commits (1)
44f88ccFix data disclosure on organization endpoints📊 Changes
2 files changed (+37 additions, -7 deletions)
View changed files
📝
src/api/core/organizations.rs(+24 -7)📝
src/db/models/organization.rs(+13 -0)📄 Description
/organization/<uuid>/keysendpoint returned also the private keys. This should not be the case. Also, according to the upstream server code the endpoint changed, but the clients do not seem to use it. I added it anyway just in case they will in the future.Fixes: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-39925
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.