[7.0] users with write access on Partners can change any user's password if "Enable password reset from Login page" is enabled

[Ludo (Neobis)]

Through some testing I have discovered a potential security risk in OpenERP version 7. In order to trigger the risk, the following needs to be true:

- User administrator does not have an email-adres configured
- The option "Enable password reset from Login page" must be checked (True)
- There must be a user with the minimum amount of rights and the chatter at his disposal

Steps to reproduce:

1. Login as minimal user
2. Create an object of some kind (for example, a simple sales order)
3. Save the object
4. In the bottom right corner, if admin is a follower, remove him from the list
5. Click the "Add others" button
6. Search for administrator and click to select him
Because this account has no email-address filled in, the limited user will be presented with a form, explaining that the email-address is a required field. You may now enter any address desired.
7. Fill in an email-address and press save.
8. Discard the invitation and logout
9. On the login page, type name = 'admin' and click the "Reset password" button.

If configured correctly, you should now get an email to be able to reset the admin password to anything desired.

The OpenERP version I used is 7.

I used the following branches to test this scenario:
Server: 4900
Addons: 8881
Web: 3850

I don't think it is relevant, but I tested used Ubuntu server 12.04.

[Ludo (Neobis) (ludo-neobis)]

Small update:

I found out that it is part of the checkbox "partner creation" on the user rights. As soon as that checkbox is ticked off (False), you are no longer able to modify the administrator's email address, even through chatter.

However, if only this box is checked, by default, then the limited account is able to alter information on any contact by simply removing the "customers" filter on the customers view. Now you are able to change different fields on for example the "admin" account.

I.m.h.o. this should be only for customers or suppliers.

[Stefan Rijnhart (Opener) (stefan-opener)]

Good find! Making the email address on the user model a related field on the partner record suddenly seems a pretty bad idea.

[Olivier Dony (Odoo) (odo-openerp)]

Hi Ludo,

Your analysis is quite correct, and this stems from the fact that "res.users" inherits from "res.partner". Among the inherited fields there will be the email field, which is therefore editable for any user that has management access on the partners.

There is no need for more convoluted steps than this: Partner Managers can edit any user, so if reset password is enabled on login page they can hijack the admin account.

We must restrict operations on the res.partner records that are parent of res.users, so that at least the email field cannot be edited.

Thanks for reporting!

[Dharmang Soni (OpenERP) (dpr-openerp)]

Hello,

It has been fixed into https://code.launchpad.net/~openerp-dev/openobject-server/7.0-bug-1157839-dharmang branch with following

Revision ID: <email address hidden>
Revision No: 4927

Thank you,
Dharmang Soni

[Ruchir Shukla(BizzAppDev) (ruchir.shukla)]

What If I am a second level Admin and not a Super user? I think it will not allow me to change any partner data for any user.

Is that mean To change partner data of user you need to be a SUPER ADMIN ?

[Stefan Rijnhart (Opener) (stefan-opener)]

Hi Ruchir,

well spotted! You should review the attached merge proposal with 'needs fixing'.

[Ruchir Shukla(BizzAppDev) (ruchir.shukla)]

Hello!

I have added constraints for "email" field in res.partner object.
1. that constraints check for the user group and will allow "Technical Feature" group users to change all users' email address.
2. User can change his own address.
3. Super user also can change all users' email address