io.openremote:openremote-manager: Cross-realm gateway websocket events are not checked against the GatewayConnector realm

Summary

Once a gateway websocket session is established only the gateway ID is used to lookup the GatewayConnector to handle the event, this means that if a user in realm A with WRITE:ADMIN role knows the ID of a gateway in realm B they can create a service user for that gateway ID in realm A and then via a websocket client they can connect to the GatewayConnector for realm B thus allowing them to impersonate that gateway across realms.

Details

GatewayService.onGatewayMessageIntercept() does a simple username ID check in isGatewayClientId() but does not pass the authenticated gateway service user's realm to GatewayService.processGatewayConnected(), GatewayService.processGatewayDisconnected(), GatewayService.processGatewayMessage() which means that provided a service user in Realm A is correctly named with the ID of a gateway in Realm B, any messages received for the user will be forwarded to the GatewayConnector.

Proof of concept

• Find the gateway ID of a gateway asset in Realm B (potentially from logs or other exploitable means)
• As a user with WRITE:ADMIN in realm A create a service user with the username gateway-GATEWAY_ID_IN_LOWER_CASE
• Use a websocket client to connect to the manager websocket server and send any information to perform CRUD operations on Gateway descendant assets in Realm B

Impact

The rogue user would be able to create SSH tunnels during initial sync handshake thus gaining access to the local network of the gateway.

The rogue user can completely overwrite the Gateway Asset descendant assets but cannot read existing assets, this is more a destructive impact as existing assets will be lost.

The rogue user in Realm A would need WRITE:ADMIN role and know the gateway ID from Realm B which mitigates the attack