Uploaded image for project: 'Bitbucket Data Center'
  1. Bitbucket Data Center
  2. BSERV-19859

Access Tokens can be used to access endpoints that they shouldn't be allowed to

XMLWordPrintable

      Issue Summary

      This is reproducible on Data Center: Yes

      According to the documentation, HTTP Access Tokens are designed to allow authentication  for REST URLs and for Git hosting requests over HTTP, but they can be used to access URLs other than these too. This shouldn't be possible. 

      Steps to Reproduce

      1. Create an HTTP Access token with REPO_READ permissions for a given repository
      2. Access a non-REST or Git hosting request using this token for authentication. One such example is a non-REST endpoint for retrieving the raw content of a file, $BASE_URL/projects/<project_key>/repos/<repo_slug>/raw/file.txt

      Expected Results

      The call isn't successful. Response status code varies depending on how the Access token is used for authentication:

      • If the token is used in Bearer Authentication, a 302: FOUND is returned
      • If the token is used in Basic Authentication, a 401: UNAUTHORIZED is returned, and repeated requests will eventually trigger Captcha as the system attempts to protect itself from bad actors. 

      Actual Results

      The call is successful and in this case, the content of the file is returned.

      Workaround

      Access tokens are not meant to be used for non-REST or Git requests, so use a supported REST API or a Git request instead. 
      In this case, the supported REST API to retrieve the content of the file would be 

      $BASE_URL/rest/api/latest/projects/<project_key>/repos/<repo_slug>/raw/file.txt

       

            [BSERV-19859] Access Tokens can be used to access endpoints that they shouldn't be allowed to

            There are no comments yet on this issue.

              csubraveti Chandravadan
              csubraveti Chandravadan
              Affected customers:
              0 This affects my team
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: