Atlassian Jira <7.13.3/8.0.0-8.1.1 - Incorrect Authorization

mediumseverity

5.3CVSS score

13.6%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Atlasssian Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 is susceptible to incorrect authorization. The ManageFilters.jspa resource allows a remote attacker to enumerate usernames via an incorrect authorization check, thus possibly obtaining sensitive information, modifying data, and/or executing unauthorized operations.

Impact

The vulnerability allows unauthorized users to access sensitive information or perform unauthorized actions.

Fix

Ensure this permission is restricted to specific groups that require it via Administration > System > Global Permissions. Turning the feature off will not affect existing filters and dashboards. If you change this setting, you will still need to update the existing filters and dashboards if they have already been shared publicly. Since Jira 7.2.10, a dark feature to disable site-wide anonymous access was introduced.

How to confirm it

Send: GET {{BaseURL}}/secure/ManageFilters.jspa?filter=popular&filterView=popular
Positive when: contains "<span data-filter-field=\"owner-full-name\">" and "<title>Manage Filters - Jira</title>"

Run it with nuclei: nuclei -id CVE-2019-3401 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-3401

info:
  name: Atlassian Jira <7.13.3/8.0.0-8.1.1 - Incorrect Authorization
  author: TechbrunchFR,milo2012
  severity: medium
  description: Atlasssian Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 is susceptible to incorrect authorization. The ManageFilters.jspa resource allows a remote attacker to enumerate usernames via an incorrect authorization check, thus possibly obtaining sensitive information, modifying data, and/or executing unauthorized operations.
  impact: |
    The vulnerability allows unauthorized users to access sensitive information or perform unauthorized actions.
  remediation: Ensure this permission is restricted to specific groups that require it via Administration > System > Global Permissions. Turning the feature off will not affect existing filters and dashboards. If you change this setting, you will still need to update the existing filters and dashboards if they have already been shared publicly. Since Jira 7.2.10, a dark feature to disable site-wide anonymous access was introduced.
  reference:
    - https://jira.atlassian.com/browse/JRASERVER-69244
    - https://nvd.nist.gov/vuln/detail/CVE-2019-3401
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2019-3401
    cwe-id: CWE-863
    epss-score: 0.13582
    epss-percentile: 0.96492
    cpe: cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: atlassian
    product: jira
    shodan-query:
      - http.component:"Atlassian Jira"
      - http.component:"atlassian jira"
      - http.component:"atlassian confluence"
      - cpe:"cpe:2.3:a:atlassian:jira"
  tags: cve,cve2019,jira,atlassian,exposure,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/secure/ManageFilters.jspa?filter=popular&filterView=popular"

    matchers:
      - type: word
        words:
          - '<span data-filter-field="owner-full-name">'
          - '<title>Manage Filters - Jira</title>'
        condition: and

# Remediation:
# Ensure that this permission is restricted to specific groups that require it.
# You can restrict it in Administration > System > Global Permissions.
# Turning the feature off will not affect existing filters and dashboards.
# If you change this setting, you will still need to update the existing filters and dashboards if they have already been
# shared publicly.
# Since Jira 7.2.10, a dark feature to disable site-wide anonymous access was introduced.

References

Use this check only on systems you are authorised to test. Where the data comes from