KIE Workbench Security Vulnerability - “USER” role is able to see assets and can update doing a URL copy from admin user's screen

[ahmedza]

I am getting the following user right issues with the KIE-WORKBECNH login.

Problem Statement

"USER" role is able to see assets and can update assets. As per documentation, User role can not view or modify an asset. This is happening following the below steps of copying URLs. Screen shots are attached for reference. (Screen Shots attached)

Versions Used 1. 6.1.0.Final

Steps To Reporoduce

1. Login with Admin/Developer role.
2. Open an asset in KIE Workbench. Example, open a BPMN2 file.
3. Copy the URL.
4. Logout from Admin/Developer role
5. Login as USER role
6. Paste the URL from STEP# 3

After performing above steps "USER" role is able to change update the asset.Expected Solution

1. Can the security be enabled using a configuration
2. Or is this a security loop hole that needs a patch.
3. Kindly let us know, if it is fixed in KIE-WORKBENCH 6.2.0.Final

[abhijithumbe]

Hi,

I can see same behavior with jBPM  6.2 release as well. I have reported this issue in https://issues.jboss.org/browse/JBPM-4633 . For now I cant see any workaround for this issue. guys, do we have ?

[ahmedza]

HI Abhijit,

Thanks for reply. I also tried on 6.2.0.Final Workbench , and the issue persists there also.

The JIRA link ( https://issues.jboss.org/browse/JBPM-4633) you mentioned in your comment is not opening, the page is giving error. Is it raised successfully ? Kindly verify.

[abhijithumbe]

Hi,

Yes, this jira is raised successfully.But this jira has restricted access because of this you are not able to see this.

[ahmedza]

Hi Abhijit,

is there any progress on the Jira Ticket ?

Regards,

Zahid