Bitbucket Repository Access Token

ID

bitbucket_repository_token

Severity

high

Vendor

Atlassian

Family

API Token

Description

A Bitbucket Repository Access Token is linked to a repository, and can be used for scripting tasks and integrating tools (such as CI/CD tools) with Bitbucket Cloud.

Security

A Bitbucket Repository Access Token can be used to authenticate API calls, limited to the repository it was created for. It has limited permissions (scopes) given at creation time, and can be seen only when created, which could be an incentive to write it down in a file that could be leaked.

They don’t expire and have no expiry date. They will stop working only when they are revoked.

Note that in addition to repository access tokens, similar tokens can be created at the project and workspace levels.

Examples

git clone https://x-token-auth:ATCTT3xFfGN0shEGxO...yCgHY@bitbucket.org/myorg/myrepo.git

Mitigation / Fix

Follow your policy for handling leaked secrets, which typically requires rotating the leaked access token. To do this, you must first generate a new token with the appropriate scope, then replace the leaked access token with the new one in all affected applications and services, and then revoke the leaked token.

An alternative is to revoke first, which shortens the exposure window but may also break existing applications and services that depend on the leaked token.

  1. For revocation, go to your Bitbucket repository, click on Repository Settings, then on Security / Access tokens, and for the affected token click on the Revoke link and again on the Revoke button in the confirmation dialog.

    As a shortcut, you may go to https://bitbucket.org/WORKSPACE/REPOSITORY/admin/access-tokens.

  2. Check access logs to ensure that the secret was not used by unintended actors during the compromised period. The last accessed column on the access token page may give some hints on unexpected accesses.

  3. Optionally, remove the revoked access token from the source code or committed configuration file.

You should consider any repository access token in a commit as compromised, and revoking is the first thing to do.

Remember that secrets may be removed from history in your projects, but not in other users' cloned or forked repositories.

Reference