[
https://issues.apache.org/jira/browse/KNOX-3411?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tamás Hanicz resolved KNOX-3411.
--------------------------------
Fix Version/s: 2.1.1
(was: 3.1.0)
Resolution: Fixed
> KnoxToken getUserTokens returns every user's token metadata without a caller
> authorization check
> ------------------------------------------------------------------------------------------------
>
> Key: KNOX-3411
> URL: https://issues.apache.org/jira/browse/KNOX-3411
> Project: Apache Knox
> Issue Type: Bug
> Components: Server
> Affects Versions: 2.1.0, 3.0.0
> Reporter: Tamás Hanicz
> Assignee: Tamás Hanicz
> Priority: Blocker
> Fix For: 3.0.0, 2.1.1
>
> Time Spent: 0.5h
> Remaining Estimate: 0h
>
> Reported by Andrew Rukin
>
> Apache Knox lets an authenticated user list another user's JWT, API_KEY, and
> CLIENT_ID token records and metadata. The same user can disable or re-enable
> another user's managed tokens by token ID. Knox already enforces ownership
> checks for token revoke. A low-privileged user cannot revoke another user's
> token and receives HTTP 403. The same user can still call disable or enable
> with another user's token ID, receive HTTP 200, and change that token's
> enabled state. I confirmed direct operational impact on official Apache Knox
> 2.1.0. After one low-privileged user disabled another user's managed token,
> the same bearer token immediately stopped working against a JWT-protected
> REST endpoint and returned HTTP 401 "Token ... is disabled".
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
