[et_pb_section fb_built=\"1\" _builder_version=\"4.9.4\" _module_preset=\"default\" background_color=\"#2E353D\" custom_padding=\"||0px|||\"][et_pb_row _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_column type=\"4_4\" _builder_version=\"4.9.4\" _module_preset=\"default\"][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" hover_enabled=\"0\" sticky_enabled=\"0\"]<\/p>\n
<\/span> Bitbucket allows the import of external repositories. A username and personal access token must be provided when importing repositories from GitHub Enterprise. These credentials get base64 encoded and sent in an import request with Basic Auth.<\/p>\n It is possible to send such import requests using the unencrypted HTTP protocol. In this case, base64 offers no protection to the credentials and an attacker who performs a man-in-the-middle attack can capture the Basic Auth string and convert it into plain text.<\/p>\n 1. Go to the repository import page (\u201e\/plugins\/servlet\/import-repository\/~USERNAME#landing-page\u201c) and enter a URL starting with \u201ehttp:\/\/\u201c into the \u201eServer URL\u201c field and enter your credentials into the \u201eUsername\u201c and \u201ePersonal access token\u201c fields:<\/span><\/p>\n [\/et_pb_text][et_pb_image src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2021\/07\/usd20200024_01.png\" _builder_version=\"4.9.4\" _module_preset=\"default\" title_text=\"usd20200024_01\" hover_enabled=\"0\" sticky_enabled=\"0\"][\/et_pb_image][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" hover_enabled=\"0\" sticky_enabled=\"0\"]<\/p>\n 2. The MitM attacker can see the unencrypted HTTP request sent by the Atlassian HttpClient:<\/span><\/p>\n [\/et_pb_text][et_pb_image src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2021\/07\/usd20200024_02.png\" _builder_version=\"4.9.4\" _module_preset=\"default\" title_text=\"usd20200024_02\" hover_enabled=\"0\" sticky_enabled=\"0\"][\/et_pb_image][et_pb_image src=\"https:\/\/herolab.usd.de\/wp-content\/uploads\/sites\/9\/2021\/07\/usd20200024_03.png\" _builder_version=\"4.9.4\" _module_preset=\"default\" title_text=\"usd20200024_03\" hover_enabled=\"0\" sticky_enabled=\"0\"][\/et_pb_image][et_pb_text _builder_version=\"4.9.4\" _module_preset=\"cc5ac6f4-ebbd-4b3f-bc92-4dfc1f15fe2c\" hover_enabled=\"0\" sticky_enabled=\"0\"]<\/p>\n Consider to only allow encrypted (HTTPS) connections for the Github Enterprise importing feature. If this is not possible, it might still be an added benefit to warn the end-user about the possible risks before sending the credentials unencrypted.<\/span><\/p>\n This security vulnerability was found by Marcus Nilsson of usd AG.<\/span><\/p>\n<\/div>\n<\/div>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":" usd-2020-0024 (CVE-2020-14171) | Bitbucket Server 7.2.3 Advisory ID: usd-2020-0024CVE Number: CVE-2020-14171Affected Product: Bitbucket ServerAffected Version: 4.9.0 <= version < 7.2.4Vulnerability Type: Unencrypted ServiceSecurity Risk: MediumVendor URL: https:\/\/www.atlassian.com\/de\/software\/bitbucketVendor Status: Fixed Description Bitbucket allows the import of external repositories. A username and personal access token must be provided when importing repositories from GitHub Enterprise. These credentials get […]<\/p>\n","protected":false},"author":96,"featured_media":0,"parent":16124,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_et_pb_use_builder":"on","_et_pb_old_content":"","_et_gb_content_width":"","inline_featured_image":false,"footnotes":""},"class_list":["post-16671","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16671","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/users\/96"}],"replies":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/comments?post=16671"}],"version-history":[{"count":0,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16671\/revisions"}],"up":[{"embeddable":true,"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/pages\/16124"}],"wp:attachment":[{"href":"https:\/\/herolab.usd.de\/en\/wp-json\/wp\/v2\/media?parent=16671"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
Advisory ID<\/strong>: usd-2020-0024<\/span>
CVE Number<\/strong>: CVE-2020-14171<\/span>
Affected Product<\/strong>: Bitbucket Server<\/span>
Affected Version<\/strong>: 4.9.0 <= version < 7.2.4<\/span>
Vulnerability Type<\/strong>: Unencrypted Service<\/span>
Security Risk<\/strong>: Medium<\/span>
Vendor URL<\/strong>: https:\/\/www.atlassian.com\/de\/software\/bitbucket<\/a><\/span>
Vendor Status<\/strong>: Fixed<\/span><\/p>\n<\/h3>\n
Description<\/h3>\n
<\/h3>\n
Proof of Concept (PoC)<\/h3>\n
Fix<\/h3>\n
<\/h3>\n
Timeline<\/h3>\n
\n
<\/h3>\n
Credits<\/h3>\n