[
https://issues.apache.org/jira/browse/KNOX-3411?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tamás Hanicz updated KNOX-3411:
-------------------------------
Description:
Reported by Andrew Rukin
Apache Knox lets an authenticated user list another user's JWT, API_KEY, and
CLIENT_ID token records and metadata. The same user can disable or re-enable
another user's managed tokens by token ID. Knox already enforces ownership
checks for token revoke. A low-privileged user cannot revoke another user's
token and receives HTTP 403. The same user can still call disable or enable
with another user's token ID, receive HTTP 200, and change that token's enabled
state. I confirmed direct operational impact on official Apache Knox 2.1.0.
After one low-privileged user disabled another user's managed token, the same
bearer token immediately stopped working against a JWT-protected REST endpoint
and returned HTTP 401 "Token ... is disabled".
> KnoxToken getUserTokens returns every user's token metadata without a caller
> authorization check
> ------------------------------------------------------------------------------------------------
>
> Key: KNOX-3411
> URL: https://issues.apache.org/jira/browse/KNOX-3411
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 2.1.0, 3.0.0
> Reporter: Tamás Hanicz
> Assignee: Tamás Hanicz
> Priority: Blocker
> Fix For: 3.0.0, 3.1.0
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> Reported by Andrew Rukin
>
> Apache Knox lets an authenticated user list another user's JWT, API_KEY, and
> CLIENT_ID token records and metadata. The same user can disable or re-enable
> another user's managed tokens by token ID. Knox already enforces ownership
> checks for token revoke. A low-privileged user cannot revoke another user's
> token and receives HTTP 403. The same user can still call disable or enable
> with another user's token ID, receive HTTP 200, and change that token's
> enabled state. I confirmed direct operational impact on official Apache Knox
> 2.1.0. After one low-privileged user disabled another user's managed token,
> the same bearer token immediately stopped working against a JWT-protected
> REST endpoint and returned HTTP 401 "Token ... is disabled".
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
