Uploaded image for project: 'Bamboo Data Center'
  1. Bamboo Data Center
  2. BAM-3239

REST API updateAndBuild.action can be abused if no IP address is specified

XMLWordPrintable

    • Icon: Suggestion Suggestion
    • Resolution: Obsolete
    • None
    • REST API
    • None
    • 0
    • 1

    • Our product teams collect and evaluate feedback from a number of different sources. To learn more about how we use customer feedback in the planning process, check out our new feature policy.

      currently no authorization is required - updateAndBuild.action is designed to work with repository scripts to push builds from the repository server. It is not designed to be used by 'users' from a random IP address. Thus the IP address of the repository has to be specified to make this command api call safe. Otherwise it is not safe and can be abused. The IP address field should not be optional. It should be dedicated to the repository IP address to avoid a possible remote attack.

            [BAM-3239] REST API updateAndBuild.action can be abused if no IP address is specified

            Bob Swift added a comment -

            I disagree with statement about IP address field should not be optional. I believe that build plans should not have to specify this field with the assumption that anything coming from the source control server is ok (without authorization) and all others are denied. Coding in absolute IP addresses in build plans should be avoided as it is a maintenance burden.

            Bob Swift added a comment - I disagree with statement about IP address field should not be optional . I believe that build plans should not have to specify this field with the assumption that anything coming from the source control server is ok (without authorization) and all others are denied. Coding in absolute IP addresses in build plans should be avoided as it is a maintenance burden.

            Ulrich Kuhnhardt [Atlassian] added a comment -

            https://support.atlassian.com/browse/BSP-1361

            Ulrich Kuhnhardt [Atlassian] added a comment - https://support.atlassian.com/browse/BSP-1361

              Unassigned Unassigned
              ukuhnhardt Ulrich Kuhnhardt [Atlassian]
              Votes:
              1 Vote for this issue
              Watchers:
              0 Start watching this issue

                Created:
                Updated:
                Resolved: