User Admin is able to delete / lock out system admin

[janrudolph]

Description:

We added a role called user admin. The user admin is allowed to administrate users (e.g. adding new ones, activation, editing) and to administrate channels. The user admin should not have access to other system options. He should do the basic daily work. The user admin has the following rights:

• add-user-to-any-c-room
• archive-room
• ban-user
• bulk-register-user
• create-user
• delete-c
• delete-d
• delete-message
• delete-p
• edit-message
• edit-other-user-active-status
• edit-other-user-info
• edit-other-user-password
• manage-emoji
• mute-user
• post-readonly
• remove-user
• set-moderator
• set-owner
• set-readonly
• unarchive-room
• view-full-other-user-info
• view-room-administration
• view-user-administration

Actual behavior:

With this permissions the user admin is able to deactivate the system admin. Thereby the system admin will be locked out of the system - the system is not manageable anymore. If you grant the user admin the right "delete users", the user admin is also able to delete the system admin.

This behavior is a potential threat.

Expected behavior:

The user admin should be able to manage regular users but not system admins. The management of system admins should be done by system admins only.

Server Setup Information:

• Version of Rocket.Chat Server: 0.56.0
• Operating System: Linux
• Deployment Method(snap/docker/tar/etc): AWS
• Number of Running Instances: 2
• Node Version: v4.8.2

Steps to Reproduce:

1. Define a new role "user admin" with the permissions depicted above
2. Create a new user, attach the new role to this user
3. Deactivate the system admin

[MartinSchoeler]

Maybe create a new permission like Manage Admin Users or make it so that only people with the view-privileged-setting permission can handle other admin users

[ruKurz]

@MartinSchoeler I don't understand your suggestion. Deleting an user of the role "admin" should only be allowed by other admin users. The responsibility to make sure no other roles are permitted to delete admins must be part of the Rocket.Chat core. IMHO nobody, nobody, nobody should be able to delete the "root user". Currently it is possible within Rocket.Chat to create a user with non admin permissions that is able to delete admins and therefore a "normal user" is able to kill your installation. This must be prevented.

[ruKurz]

Any updates here?