[
https://issues.apache.org/jira/browse/KNOX-3410?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tamás Hanicz resolved KNOX-3410.
--------------------------------
Resolution: Fixed
> KnoxToken enable/disable endpoints perform no caller authorization
> ------------------------------------------------------------------
>
> Key: KNOX-3410
> URL: https://issues.apache.org/jira/browse/KNOX-3410
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 2.1.0, 3.0.0
> Reporter: Tamás Hanicz
> Assignee: Tamás Hanicz
> Priority: Blocker
> Fix For: 3.0.0, 2.1.1
>
> Time Spent: 50m
> Remaining Estimate: 0h
>
> Reported by Andrew Rukin
>
> Apache Knox lets an authenticated user list another user's JWT, API_KEY, and
> CLIENT_ID token records and metadata. The same user can disable or re-enable
> another user's managed tokens by token ID. Knox already enforces ownership
> checks for token revoke. A low-privileged user cannot revoke another user's
> token and receives HTTP 403. The same user can still call disable or enable
> with another user's token ID, receive HTTP 200, and change that token's
> enabled state. I confirmed direct operational impact on official Apache Knox
> 2.1.0. After one low-privileged user disabled another user's managed token,
> the same bearer token immediately stopped working against a JWT-protected
> REST endpoint and returned HTTP 401 "Token ... is disabled".
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
