[
https://issues.apache.org/jira/browse/KNOX-3411?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tamás Hanicz updated KNOX-3411:
-------------------------------
Description: (was: Reported by Andrew Rukin
Apache Knox lets an authenticated user list another user's JWT, API_KEY, and
CLIENT_ID token records and metadata. The same user can disable or re-enable
another user's managed tokens by token ID. Knox already enforces ownership
checks for token revoke. A low-privileged user cannot revoke another user's
token and receives HTTP 403. The same user can still call disable or enable
with another user's token ID, receive HTTP 200, and change that token's enabled
state. I confirmed direct operational impact on official Apache Knox 2.1.0.
After one low-privileged user disabled another user's managed token, the same
bearer token immediately stopped working against a JWT-protected REST endpoint
and returned HTTP 401 "Token ... is disabled".)
> Improve getUserToken method
> ---------------------------
>
> Key: KNOX-3411
> URL: https://issues.apache.org/jira/browse/KNOX-3411
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 2.1.0, 3.0.0
> Reporter: Tamás Hanicz
> Assignee: Tamás Hanicz
> Priority: Blocker
> Fix For: 3.0.0, 2.1.1
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
