{"id":16615,"date":"2021-07-08T10:52:44","date_gmt":"2021-07-08T08:52:44","guid":{"rendered":"https:\/\/herolab-usd.formwandler.rocks\/security-advisories\/usd-2019-0020\/"},"modified":"2021-07-19T14:11:39","modified_gmt":"2021-07-19T12:11:39","slug":"usd-2019-0020","status":"publish","type":"page","link":"https:\/\/herolab.usd.de\/en\/security-advisories\/usd-2019-0020\/","title":{"rendered":"usd-2019-0020"},"content":{"rendered":"<p>[et_pb_section fb_built=\"1\" _builder_version=\"4.9.4\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\"][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n<h1 class=\"h-custom-headline usd-small-letters h2\"><span>usd-2019-0020 | Bitbucket\/v5.10.1<\/span><\/h1>\n<p><span><\/span><br \/><strong>Advisory ID<\/strong><span>: usd-2019-0020<\/span><br \/><strong>CVE Number<\/strong><span>: N\/A<\/span><br \/><strong>Affected Product<\/strong><span>: Bitbucket<\/span><br \/><strong>Affected Version<\/strong><span>: v5.10.1<\/span><br \/><strong>Vulnerability Type<\/strong><span>: Sensitive Data in URL<\/span><br \/><strong>Security Risk<\/strong><span>: Low<\/span><br \/><strong>Vendor URL<\/strong><span>: <\/span><a href=\"https:\/\/www.atlassian.com\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.atlassian.com<\/a><br \/><strong>Vendor Status<\/strong><span>: Not fixed<\/span><\/p>\n<h3><\/h3>\n<h3>Description<\/h3>\n<p><span>Rather than directly attacking crypto, attackers steal keys, execute man-in-the-middle attacks or steal clear text data of the server while in transit or from the user\u2019s client e.g. browser. A manual attack is generally required.<\/span><\/p>\n<p><span><\/span><\/p>\n<h3>Proof of Concept\u00a0<\/h3>\n<p>If an user changes his profile picture, the CSRF token is transfered inside the URL. The CSRF token does not change after that and is valid for the whole session.<\/p>\n<p>Request:<\/p>\n<p>[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"9e260d37-0be2-4a12-a10e-3ed7e27b6ac6\" hover_enabled=\"0\" sticky_enabled=\"0\"]POST \/stash-kons\/users\/alice\/avatar.png?atl_token=44df79fc27cf40a3ca9df08686400f095f242d92 HTTP\/1.1<br \/>\nHost: hostname<br \/>\nConnection: close<br \/>\nContent-Length: 27979<br \/>\nAccept: *\/*<br \/>\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/72.0.3626.109 Safari\/537.36<br \/>\nContent-Type: application\/x-www-form-urlencoded; charset=UTF-8<br \/>\nAccept-Encoding: gzip, deflate<br \/>\nAccept-Language: en-US,en;q=0.9<br \/>\nCookie: BITBUCKETSESSIONID=5DD59366F93308291C8EC6C0BCBF4184<\/p>\n<p>[\u2026]<\/code><\/pre>\n<p>[\/et_pb_text][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\"]<\/p>\n<div class=\"e16902-22 x-container max width\">\n<div class=\"e16902-23 x-column x-sm x-1-1\">\n<h3>Fix<\/h3>\n<p><span>Send the CSRF token as POST parameter.<\/span><\/p>\n<h3><\/h3>\n<h3>Timeline<\/h3>\n<ul>\n<li>2019-03-28 Vulnerability securily submitted to security@atlassian.com<\/li>\n<li>2019-04-11 Second contact attempt via <a href=\"https:\/\/getsupport.atlassian.com\/\" target=\"_blank\" rel=\"noopener\">contact formular<\/a><\/li>\n<li>2019-05-23 Atlassian Security Team agreed with the publishment of the advisory<\/li>\n<li>2019-07-31 Security advisory released<\/li>\n<\/ul>\n<h3><\/h3>\n<h3>Credits<\/h3>\n<p><span>This security vulnerabilities were found by Tobias Neitzel and Julian Frey of usd AG.<\/span><\/p>\n<\/div>\n<\/div>\n<p>[\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"<p>usd-2019-0020 | Bitbucket\/v5.10.1 Advisory ID: usd-2019-0020CVE Number: N\/AAffected Product: BitbucketAffected Version: v5.10.1Vulnerability Type: Sensitive Data in URLSecurity Risk: LowVendor URL: https:\/\/www.atlassian.comVendor Status: Not fixed Description Rather than directly attacking crypto, attackers steal keys, execute man-in-the-middle attacks or steal clear text data of the server while in transit or from the user\u2019s client e.g. browser. A [&hellip;]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16615","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16615","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16615"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16615\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16615"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}