security(core): stop scoped tokens from escalating via token create and login (24.05) - #7958
Closed
ar2rsawseen wants to merge 1 commit into
Closed
security(core): stop scoped tokens from escalating via token create and login (24.05)#7958ar2rsawseen wants to merge 1 commit into
ar2rsawseen wants to merge 1 commit into
Conversation
…nd login Backport of #7957 to release.24.05. A token's app/endpoint restriction is a data-scoping control that does not gate /i/token/create (no app_id there), and validateUser resolves any bearer token to the full member. The create handler then saved caller-supplied app/endpoint/purpose with no relationship to the authenticating credential, and /login/token/:token granted the owner's full session from any token carrying a login purpose regardless of scope. So a token scoped to one app could mint an unrestricted or LoggedInAuth token and take over the owner's entire account. Close it from both ends: token creation is allowed only from a full-permission credential (api_key, or a token with no app and no endpoint restriction), and /login/token requires the token to be unrestricted in addition to the purpose allowlist. api_key callers and unrestricted tokens - which is what a dashboard session token is - are unaffected. Tests: 7 cases in test/2.api/16.token.manager.js. Reported through the security bug bounty programme (received 2026-08-18). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Member
Author
|
Closing in favor of a broader token-model rework that addresses this at the root rather than with the two containment checks here. The branch is retained as a fallback and can be reopened if needed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #7957 to
release.24.05.A token scoped to one app could escalate to the owner's full account:
/i/token/createisn't gated by the token's app/endpoint restriction (it carries noapp_id),validateUserresolves any bearer token to the full member, the handler saved caller-suppliedapp/endpoint/purposewith no relationship to the creating credential, and/login/token/:tokenthen granted the owner's full session from any token with a login purpose regardless of scope.Fix (identical to #7957), both ends:
/i/token/createvia a token is allowed only if that token has no app and no endpoint restriction; api_key callers and unrestricted tokens (what a dashboard session token is) are unaffected./login/token/:tokenadditionally requires the token to be unrestricted; legitimate session tokens always are.7 regression tests in
test/2.api/16.token.manager.js(run bytest-api-core). eslint clean.🤖 Generated with Claude Code