Atlassian Jira Server-Side Template Injection

Exploited in the wild. Listed by CISA on 2022-03-07; known to be used by ransomware.

criticalseverity

9.8CVSS score

84.6%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Jira Server and Data Center is susceptible to a server-side template injection vulnerability via the ContactAdministrators and SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.

Impact

Successful exploitation of this vulnerability can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system.

Fix

Apply the necessary security patches or upgrade to a fixed version provided by Atlassian to mitigate this vulnerability.

How to confirm it

Send: GET {{BaseURL}}/secure/ContactAdministrators!default.jspa
Positive when: contains "Contact Site Administrators" AND not contains "has not yet configured this contact form" AND matches /\(v4\.4\./

Run it with nuclei: nuclei -id CVE-2019-11581 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-11581

info:
  name: Atlassian Jira Server-Side Template Injection
  author: ree4pwn
  severity: critical
  description: Jira Server and Data Center is susceptible to a server-side template injection vulnerability via the ContactAdministrators and SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
  impact: |
    Successful exploitation of this vulnerability can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system.
  remediation: |
    Apply the necessary security patches or upgrade to a fixed version provided by Atlassian to mitigate this vulnerability.
  reference:
    - https://github.com/jas502n/CVE-2019-11581
    - https://jira.atlassian.com/browse/JRASERVER-69532
    - https://nvd.nist.gov/vuln/detail/CVE-2019-11581
    - https://github.com/0x48piraj/jiraffe
    - https://github.com/bakery312/Vulhub-Reproduce
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-11581
    cwe-id: CWE-74
    epss-score: 0.84621
    epss-percentile: 0.99707
    cpe: cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: atlassian
    product: jira
    shodan-query:
      - http.component:"Atlassian Jira"
      - http.component:"atlassian jira"
      - http.component:"atlassian confluence"
      - cpe:"cpe:2.3:a:atlassian:jira"
  tags: cve,cve2019,atlassian,jira,ssti,rce,kev,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/secure/ContactAdministrators!default.jspa"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Contact Site Administrators"

      - type: word
        part: body
        negative: true
        words:
          - "has not yet configured this contact form"

      - type: regex
        part: body
        regex:
          - "\\(v4\\.4\\."
          - "\\(v5\\."
          - "\\(v6\\."
          - "\\(v7\\.[012345789]\\."
          - "\\(v7\\.1[0-2]\\."
          - "\\(v7\\.6\\.([0-9]|[1][0-3])"
          - "\\(v7\\.\\13\\.[0-4]"
          - "\\(v8\\.0\\.[0-2]"
          - "\\(v8\\.1\\.[0-1]"
          - "\\(v8\\.2\\.[0-2]"
        condition: or

References

Use this check only on systems you are authorised to test. Where the data comes from