[JENKINS-73468] Fix mistaken doCheckServerUrl AccessDeniedException

[Dohbedoh]

Similar to what was once done for another field https://github.com/jenkinsci/bitbucket-branch-source-plugin/pull/377/files.
And I think was introduced by 95d5766.

Your checklist for this pull request

• Make sure you are requesting to pull a topic/feature/bugfix branch (right side) and not your master branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or in Jenkins JIRA
• Link to relevant pull requests, esp. upstream and downstream changes
• Did you provide a test-case? That demonstrates feature works or fixes the issue.

[Dohbedoh]

@Pldi23 Why was Item.CONFIGURE required as part of SECURITY-2033 on the /checkServerUrl endpoint ? According to https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2033, it was about an attacker being able to enumerate credentials ID which does not seem possible through that method ?

[Pldi23]

@Pldi23 Why was Item.CONFIGURE required as part of SECURITY-2033 on the /checkServerUrl endpoint ? According to https://www.jenkins.io/security/advisory/2022-01-12/#SECURITY-2033, it was about an attacker being able to enumerate credentials ID which does not seem possible through that method ?

I don't remember details and don't have access to SECURITY-2033 anymore to restore my memory, but looking at the code I assume that attacker can access Bitbucket configuration and be able to obtain url which can be a part of another attack.

[Dohbedoh]

@Pldi23 With the fix I propose, only authenticated and authorized users could access the bitbucket URL. So per my understanding those endpoints are still safe.

[Pldi23]

@Dohbedoh Yeah, looks safe from my point of view!

[Kevin-CB]

Otherwise, I agree with Dima, it looks safe

[Dohbedoh]

cc @jenkinsci/bitbucket-branch-source-plugin-developers