Vulnerability dashboard error loading for read-only user

[TDYK]

Wazuh	Rev	Browser
4.9.0-1	ubuntu-rep	any

Description
Vulnerability dashboard not working for read-only user

Preconditions
Wazuh Installation from repository on Ubuntu 20.04

Steps to reproduce

1. Create a read-only user as discribed in https://documentation.wazuh.com/current/user-manual/user-administration/rbac.html
2. Login with new read-only user and navigate to app/vulnerability-detection
3. The page is not loading

Error in logs:

[2024-09-10T14:02:19,459][WARN ][o.o.s.c.PrivilegesInterceptorImpl] [Wazuh-Indexer-01P] Tenant global_tenant is not allowed to write (user: readonly)
[2024-09-10T14:02:19,620][WARN ][o.o.s.c.PrivilegesInterceptorImpl] [Wazuh-Indexer-01P] Tenant global_tenant is not allowed to write (user: readonly)

Error in browser console:

PUT
https://wazuh/api/saved_objects/index-pattern/wazuh-states-vulnerabilities-*
[HTTP/2 403  25ms]

Screenshots

Other pages that work with index are working, like this:

[TDYK]

Same issue in the mailing list:
https://groups.google.com/g/wazuh/c/_w_BNaohbzE

[Desvelao]

I got to replicate the problem.

1. Create a readonly user following these steps https://documentation.wazuh.com/4.9/user-manual/user-administration/rbac.html
2. Ensure the Vulnerabilities detection in the Wazuh server is enabled and this can connect with the Wazuh indexer
3. Ensure the vulnerabilities states index was created
4. With a user with write permission on the selected tenant, go to Vulnerabilities Detection > Dashboard / Inventory, and it should create the index pattern
5. Login with the readonly user and go to Vulnerabilities Detection > Dashboard / Inventory.

The view is stucked in the Searching:

Regarding the request from the browser dev tools, there are some requests failing

{
    "statusCode": 403,
    "error": "Forbidden",
    "message": "no permissions for [indices:data/write/update] and User [name=wz-readonly, backend_roles=[], requestedTenant=null]: security_exception: [security_exception] Reason: no permissions for [indices:data/write/update] and User [name=wz-readonly, backend_roles=[], requestedTenant=null]"
}

This indicates and error trying to update the index pattern. Regarding the initiator of this request, this seems to be related the select method of the data source that is updating the index pattern data. This action can not be done by readonly users.

Related code: https://github.com/wazuh/wazuh-dashboard-plugins/blob/v4.9.0/plugins/main/public/components/common/data-source/pattern/pattern-data-source.ts#L55

For another hand, going to Events tab, this is displayed, so I assume, the select method of the data source is not called.

The difference of Events tab or Dashboard/Inventory is that the alerts index pattern can be obtained of getDefault method in https://github.com/wazuh/wazuh-dashboard-plugins/blob/v4.9.0/plugins/main/public/components/common/data-source/pattern/pattern-data-source-selector.ts#L108-L112. The alerts index pattern uses a value of index pattern ID stored in a cookie, if this does not exist at the moment to create the instance of data source, I guess the Events tab could fail in same way.

Possible solutions to apply in the fix:

• unify the behavior of alerts and vulnerabilities states index patterns
• updating the index pattern data when selecting it through the data source should not cause the view is stuck in searching
• remove the logic to update the index pattern data

In this case, the user should update manually the index pattern data (fields) through Dashboard management > Dashboard Management > Index patterns