Fix DojoGroupSerializer to handle empty permissions list

[Maffooch]

Update the DojoGroupSerializer to clear permissions when an empty list is provided, ensuring proper handling of permission updates.

[dryrunsecurity]

This pull request introduces a change that allows a user with standard Permissions.Group_Edit on a given group to clear all group permissions by submitting an empty auth_group.permissions list, effectively enabling denial-of-service for group members because there is no elevated/explicit permission check for this sensitive action. It recommends adding a stricter authorization check (or separate permission) for clearing all permissions to prevent misuse.

Authorization flaw allowing group permission clearing in dojo/api_v2/serializers.py

Vulnerability

Authorization flaw allowing group permission clearing

Description

The patch introduces a mechanism to clear all group permissions if an empty list is provided in the auth_group.permissions field. The authorization logic for updating a group (via DojoGroupViewSet and UserHasDojoGroupPermission) only checks for Permissions.Group_Edit. This means any user with Permissions.Group_Edit on a specific group can send a request to clear all permissions for that group, leading to a denial of service for its members. There is no specific, elevated permission check for the sensitive action of clearing all group permissions.

django-DefectDojo/dojo/api_v2/serializers.py

Lines 731 to 732 in 29a44ab

	if isinstance(permissions_in_payload, list) and len(permissions_in_payload) == 0:
	instance.auth_group.permissions.clear()

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved