nerves_hub_webに認証済みユーザーが他組織のデバイスやファームウェアへ書き込める脆弱性

Summary

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session's organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user's own organization, and any account can create one.

A device placed on another organization's deployment group, or moved into its product, is sent that organization's firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it.

This issue affects nerves_hub: from 1.0.0 before 2.5.3.

Details

1. Device API and device forms. NervesHubWeb.API.DeviceController.create/2 sets org_id and product_id from the route, then hands the rest of the request to Device.changeset/2; update/2 hands the whole request over. The changeset casts org_id, `pr…