[OJSI-94] sdc-wfd-fe allows to impersonate any user by setting USER_ID - ONAP JIRA

Clone

Clone+

Clone++

XML

Word

Printable

OJSI Grant Project Access:
OJSI-SDC
Epic Link:
Some ONAP services allows to impersonate any user without authentication

sdc-wfd-fe allows to impersonate any user by setting USER_ID in request
header any without any authentication

Sample attack:

curl -H ’USER_ID: abcd’ -X GET http://<IP ADDR>:30256/wf/workflows

is blocked by

SDC-2557 workflow-designer-be throws exception when it starts

relates to

SDC-2544 Remove the USER_ID field from SDC requests

mentioned in: Page Loading...; Page Loading...; Page Loading...; Page Loading...; Page Loading...; Page Loading...; Page Loading...

(4 mentioned in)

No reviews matched the request. Check your Options in the drop-down menu of this sections header.