Swagger UI Telemetry Controller - Customers can access Telemetries of other Customers (under certain conditions)

Describe the bug We discovered that customers can access other customers' device telemetry (to which they are not authorized). For this to work, the device's Device ID must be known, as well as at least the Telemetry Key. If only the device ID is known and no specific keys are specified, an error message is correctly displayed: “You don't have permission to perform the ‘READ_TELEMETRY’ operation with DEVICE ‘XXX’!” If a valid key is entered instead, customers can access the telemetry data!

We tested only via Swagger-UI and the following endpoint: /api/plugins/telemetry/{entityType}/{entityId}/values/timeseries{?keys,startTs,endTs,intervalType,interval,timeZone,limit,agg,orderBy,useStrictDataTypes,params}

Your Server Environment

• own setup
  • Deployment: monolith & microservices
  • Deployment type: deb, k8s
  • ThingsBoard Version 4.3.0.1, 4.3.1.3
  • Professional Edition

To Reproduce Steps to reproduce the behavior:

1. Create 2 Customers which are not in the same hierarchy
2. Create a User in the first Customer which belongs to the Group "Customer Users" with default role (All - Read)
3. Create a Device with some telemetry data for testing
4. Login to Swagger-UI via TB-URL/swagger-ui/ with the user created in Step 2
5. Navigate to the Telemetry Controller and the respective endpoint /api/plugins/telemetry/{entityType}/{entityId}/values/timeseries{?keys,startTs,endTs,intervalType,interval,timeZone,limit,agg,orderBy,useStrictDataTypes,params}
6. Enter required Parameters entityType: "DEVICE", entityId: (of the Device created in Step 3), keys: (key of the device of Step 3), and also valid endts & startTs where telemetry is available
7. Observe that data is successfully fetched
8. Now remove the Key parameter and leave it blank
9. Observe now that there is an No Permission error

Expected behavior It shouldn't be possible under any circumstances to get any data from different customers (where no explicit permission to do so is set).

Screenshots Customer Hierarchy:

Sample Device:

Request without keys (correct behavior):

Request with key specified (should not be possible):

---

Disclaimer

We appreciate your contribution whether it is a bug report, feature request, or pull request with improvement (hopefully). Please comply with the Community ethics policy, and do not expect us to answer your requests immediately. Also, do not treat GitHub issues as a support channel.