User with no access to _system can get/set server license

[DiscoPYF]

My Environment

• ArangoDB Version: 3.11.8
• Deployment Mode: Single Server
• Deployment Strategy: Manual Start in Docker (Docker Desktop v4.72.2, WSL version: 2.0.9.0)
• Configuration: N/A
• Infrastructure: Laptop
• Operating System: Windows 11 Pro 23H2
• Total RAM in your machine: 32Gb
• Disks in use: NVMe SSD
• Used Package: N/A

Component, Query & Data

Affected feature: Server license (user access to /_admin/license)

AQL query (if applicable): N/A

AQL explain and/or profile (if applicable): N/A

Dataset: N/A

Size of your Dataset on disk: N/A

Replication Factor & Number of Shards (Cluster only): N/A

Steps to reproduce

1. Create a new container for image arangodb/enterprise:3.11.8.
   Docker run command: docker run --hostname=<hostname> --mac-address=<mac_address> --env=ARANGO_ROOT_PASSWORD=root --env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin --env=GLIBCXX_FORCE_NEW=1 -p 8530:8529 --restart=no --runtime=runc -d arangodb/enterprise:3.11.8
2. Set a new license with root user PUT http://localhost:8530/_db/_system/_admin/license
3. Create new user jdoe
4. Create DB jdoedb
5. Set access for jdoe in the web UI ("No Access" to _system, "Access" to jdoedb)

Problem:

• Calls to get/set license with DB jdoedb and authenticated with jdoe user are successful (Tested with basic auth). jdoe is able to get and set the server license even though he doesn't have access to _system.

Success: GET http://localhost:8530/_db/jdoedb/_admin/license
Success: PUT http://localhost:8530/_db/jdoedb/_admin/license
Unauthorized: GET http://localhost:8530/_db/_system/_admin/license
Unauthorized: PUT http://localhost:8530/_db/_system/_admin/license

See screenshots below. On the left, access for jdoe user. On the right, API calls with Postman.

Expected result:

• Calls to get/set license with DB jdoedb and authenticated with jdoe user are unauthorized. jdoe is not able to get and set the server license because he doesn't have access to _system.

Unauthorized: GET http://localhost:8530/_db/jdoedb/_admin/license
Unauthorized: PUT http://localhost:8530/_db/jdoedb/_admin/license
Unauthorized: GET http://localhost:8530/_db/_system/_admin/license
Unauthorized: PUT http://localhost:8530/_db/_system/_admin/license

[asifkazi]

Will have engineering look into this, and try and test it later today, but I would suggest turning on server hardening to start with: https://docs.arangodb.com/3.11/operations/security/security-options/