Description:
The /ras/traceLevel endpoint allows any authenticated user to GET and PUT ZSS server log levels without checking RBAC authorization. The app-server's equivalent endpoint (/server/logLevels) is properly gated behind RBAC, but ZSS's /ras is not.
Current behavior:
RBAC off: any authenticated user can GET/PUT log levels
RBAC on: any authenticated user can GET/PUT log levels (identical — RBAC is ignored)
Expected behavior:
RBAC off: endpoint should return an error indicating RBAC must be enabled (same pattern as /server/agent/config)
RBAC on: endpoint should perform a SAF check against ZLUX.0.COR..RAS.TRACELEVEL and return 403 if the user lacks READ access
Impact:
Any authenticated user can set log levels to FINEST (level 5), which could cause performance degradation and potentially expose sensitive data in server logs.
Description:
The /ras/traceLevel endpoint allows any authenticated user to GET and PUT ZSS server log levels without checking RBAC authorization. The app-server's equivalent endpoint (/server/logLevels) is properly gated behind RBAC, but ZSS's /ras is not.
Current behavior:
RBAC off: any authenticated user can GET/PUT log levels
RBAC on: any authenticated user can GET/PUT log levels (identical — RBAC is ignored)
Expected behavior:
RBAC off: endpoint should return an error indicating RBAC must be enabled (same pattern as /server/agent/config)
RBAC on: endpoint should perform a SAF check against ZLUX.0.COR..RAS.TRACELEVEL and return 403 if the user lacks READ access
Impact:
Any authenticated user can set log levels to FINEST (level 5), which could cause performance degradation and potentially expose sensitive data in server logs.