2012-01-25 Instructure Advisory IAC22873 - Admin Cross-Account Password Changing

702

SECURITY UPDATE

Release Date:	2012-01-25 (Last update can be found below the document title)
Description:	Admin Cross-Account Password Changing
Criticality Level:	Less Critical ( Less Critical < Critical < Moderately Critical < Highly Critical )
Impact:	Manipulation of data
Systems Affected:	Canvas LMS
Solution Status:	Patched
Discovered By:	Internal Instructure Audit
Relevant Changesets:	https://github.com/instructure/canvas-lms/commit/f368ba7a3b5ede284238bd563a874d3a782110c8

Summary:

A vulnerability was discovered in the functionality that allows account admins to change passwords for users in their account. If there is a user with logins to both account A and account B, an admin with password changing privileges on account A could craft an HTTP request (using curl or a similar tool) that would allow the admin to change the password for that user on account B. The admin would have to discover the login (pseudonym) id for that user on account B first. This could potentially allow a malicious LMS admin to log in as a user under another account, allowing access to their private information on that second account.

Status:

Fixed in Canvas Cloud. Users of Canvas CV are encouraged to either update to the most recent stable code or apply the patch manually.

About

Bio

Jordan has had various roles in the ed tech software (SAAS) industry for the past 9 years. (almost 5 years with Instructure). In his previous company he was a Client Services Manager for two years (responsible for account management, implementation, project management, and training, for each of his customers). After a year and a half he was commissioned to build a training department, all policies and procedures, and deliver training for all customers. Over the past eight years he has been in charge of conceiving, producing and deploying eLearning initiatives and strategies. He has trained over 3,000 adult learners with a wide range of technical aptitude, including K-12 Teachers, Principals, Administrators, Superintendents, Higher Ed Professors, Doctors, CTO’s, and Corporate Business Professionals and Executives. Jordan is an instructional designer and Community Manager for Instructure with a focus on connecting Canvas users with tools and resources that will help them get excited about and become proficient in utilizing the Canvas Learning Platform.