usd-2019-0017 | Bitbucket/v5.10.1


Advisory ID: usd-2019-0017
CVE Number: N/A
Affected Product: Bitbucket
Affected Version: v5.10.1
Vulnerability Type: Sensitive Data Exposure/Credentials Disclosure
Security Risk: Low
Vendor URL: https://www.atlassian.com
Vendor Status: Not fixed

Description

Rather than directly attacking cryptography, attackers steal keys, execute man-in-the-middle attacks or steal clear text data of the server while in transit or from the user’s client e.g. browser. A manual attack is generally required.

Proof of Concept (PoC)

Inside a Bitbucket application, an administrator can integrate an Elasticsearch-Server. The password is only displayed obfuscated. It is therefore not possible to simply read the password for an already configured server. If an attacker changes the URL of the configured Elasticsearch-Server to his own HTTP server and does not change the password, the password will be sent to the newly configured server address inside a Basic-Auth Header.

To comprehend the vulnerability the following menu can be used: /rest/search-admin/latest/test-connection

Fix

When a new server is configured, user should be required to specify a new password.

Timeline

  • 2019-03-28 Vulnerability securily submitted to security@atlassian.com
  • 2019-04-11 Second contact attempt via contact formular
  • 2019-05-23 Atlassian Security Team agreed with the publishment of the advisory
  • 2019-07-31 Security advisory released

Credits

This security vulnerabilities were found by Tobias Neitzel and Julian Frey of usd AG.