Security vulnerability in rights management of Razuna

We found a bug that gives users more rights than allowed. If a user has only read-only access to a folder (and the assets inside), it is nevertheless possible to manipulate the asset informations with a trick.

To do this, it is sufficient to drop an asset into the users favorites area. After this, the user can click on the asset (or one of his favorites) to open the informations window an see all tabs (and the SAVE action button!).

In the folder view, the user has the correct access rights, so he see only the informations, but he has no possible ways to manipulate something.

We found this phenomenon in the version 1.5.x upto the latest version 1.7.0. In the users basket area this security vulnerability does not occur.

Procedure:

  1. Create a new user, and create a new group. Adding the user to this new group.
  2. Adding the new group to an asset folder (read-only access).
  3. Log in with the new user account.
  4. Drop an asset to the users favorite area.
  5. Opening the information window (in the favorite area) with a click.
  6. Now you can manipulate the informations and save them (SAVE action is allowed!)
  7. In the folder view you find the changed informations!

We will fix this in the upcoming release.

Thank you for reporting this and making Razuna better.