asapp-privilege-escalation

Context

• asApp() operates with the app's full permissions, which typically exceed those of asUser(). This creates privilege escalation risks when asApp is used without verifying the requesting user has permission for the action.
• For user-invoked actions, default to asUser() when possible. If asApp() is required, perform explicit permission verification for the same target resource before the asApp() sink.
• Related CWE: CWE-269 (Improper Privilege Management), CWE-862 (Missing Authorization).
• Past issues: EPSP-301, VULN-1628326 (Rovo A4J elevated privileges).

Scope & Signals

• Sources: Resolver payloads, web trigger requests, event payloads, Rovo agent actions.
• Sinks: api.asApp().requestJira(), api.asApp().requestConfluence(), api.asApp().requestBitbucket, api.asApp().requestGraph and other request types, storage mutations, any state-changing operations.
• Red flags:
  • asApp() calls immediately after receiving payload without permission checks.
  • Authorization checks that are missing, generic, or not bound to the same resource ID used by the sink call.
  • Using asApp() for operations the requesting user couldn't perform directly and not checking user permissions.
  • Missing validation that the user owns or has access to the target resource.

Vulnerable Patterns

// VULNERABLE - user-controlled target reaches asApp sink with no authz check
resolver.define('updateIssue', async ({ payload }) => {
  await api.asApp().requestJira(route`/rest/api/3/issue/${payload.issueId}`, {
    method: 'PUT',
    body: JSON.stringify(payload.fields)
  });
});

// VULNERABLE - check is not coupled to the same resource used in asApp sink
resolver.define('transitionIssue', async ({ payload }) => {
  // Checks permission on payload.issueId ...
  const canEdit = await authorize().onJiraIssue(payload.issueId).canEdit();
  if (!canEdit) throw new Error('Forbidden');

  // ... but mutates payload.targetIssueId (attacker-controlled)
  await api.asApp().requestJira(route`/rest/api/3/issue/${payload.targetIssueId}/transitions`, {
    method: 'POST',
    body: JSON.stringify({ transition: { id: payload.transitionId } })
  });
});

Secure Patterns

// SECURE - prefer asUser when operation should respect caller permissions
resolver.define('updateIssueAsUser', async ({ payload }) => {
  return api.asUser().requestJira(route`/rest/api/3/issue/${payload.issueId}`, {
    method: 'PUT',
    body: JSON.stringify(payload.fields)
  });
});

// SECURE - asApp only after explicit permission check on same resource
resolver.define('updateIssueAsApp', async ({ payload }) => {
  const canEdit = await authorize().onJiraIssue(payload.issueId).canEdit();
  if (!canEdit) {
    throw new Error('Forbidden');
  }

  return api.asApp().requestJira(route`/rest/api/3/issue/${payload.issueId}`, {
    method: 'PUT',
    body: JSON.stringify(payload.fields)
  });
});

// SECURE - explicit permission check via Forge auth + permissions/check endpoint
resolver.define('updateIssueWithExplicitPermissionEndpoint', async ({ payload }) => {
  const permissionRes = await api.asUser().requestJira(route`/rest/api/3/permissions/check`, {
    method: 'POST',
    headers: {
      Accept: 'application/json',
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      projectPermissions: [
        {
          permissions: ['EDIT_ISSUES'],
          issues: [Number(payload.issueId)]
        }
      ]
    })
  });

  const permissionJson = await permissionRes.json();
  const canEdit = permissionJson?.projectPermissions?.some(
    (grant) =>
      grant.permission === 'EDIT_ISSUES' &&
      Array.isArray(grant.issues) &&
      grant.issues.includes(Number(payload.issueId))
  ) === true;
  if (!canEdit) {
    throw new Error('Forbidden');
  }

  // Uses the same issueId that was authorized above.
  return api.asApp().requestJira(route`/rest/api/3/issue/${payload.issueId}`, {
    method: 'PUT',
    body: JSON.stringify(payload.fields)
  });
});