OCO-Server: Self-Service Portal uninstall-job authorization bypass

Overview

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3, a valid Self-Service Portal user with permission to create job containers and read visibility on a computer and package can queue an uninstall job without deploy permission for those resources. Requests to self-service/ajax-handler/job-containers.php pass uninstall_package_assignment_id[] values to lib/SelfService/CoreLogic.class.php::uninstallSelfService(). Its permission-check loop continues after denied METHOD_DEPLOY checks without removing rejected IDs from $installationIds, then passes the original list to lib/CoreLogic.class.php::uninstall(). The CoreLogic object is constructed with a null SystemUser, causing lib/CoreLogic.class.php::checkPermission() to treat the operation as system context and unconditionally permit it. Enumerable computer_package.id values allow selection of readable installed-package assignments, including those on other users' computers. The deploySelfService() install path instead aborts on denied deployment permission, and resources lacking read permission remain blocked. This permits unauthorized software-removal jobs across resources visible to the acting user's role. This issue is fixed in version 1.2.3.

Affected

• OCO-Server < 1.2.3

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.