Jira - Incorrect Authorization

mediumseverity

5.3CVSS score

53.6%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 is susceptible to an incorrect authorization check in the /rest/api/2/user/picker rest resource, enabling an attacker to enumerate usernames and gain improper access.

Impact

This vulnerability can lead to unauthorized access to sensitive data, potential data breaches, and unauthorized actions within the Jira system.

Fix

Apply the latest security patches and updates provided by Atlassian to fix the vulnerability and ensure proper authorization controls are in place.

How to confirm it

Send: GET {{BaseURL}}/rest/api/2/user/picker?query=
Positive when: contains(header, "application/json") and contains_any(body, "\"users\":","\"usuario\":") and contains_all(body, "\"total\":", "\"header\":") and status_code == 200 || status_code == 404 AND not contains "total\":0"

Run it with nuclei: nuclei -id CVE-2019-3403 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-3403

info:
  name: Jira - Incorrect Authorization
  author: Ganofins
  severity: medium
  description: Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 is susceptible to an incorrect authorization check in the /rest/api/2/user/picker rest resource, enabling an attacker to enumerate usernames and gain improper access.
  impact: |
    This vulnerability can lead to unauthorized access to sensitive data, potential data breaches, and unauthorized actions within the Jira system.
  remediation: |
    Apply the latest security patches and updates provided by Atlassian to fix the vulnerability and ensure proper authorization controls are in place.
  reference:
    - https://jira.atlassian.com/browse/JRASERVER-69242
    - https://nvd.nist.gov/vuln/detail/CVE-2019-3403
    - https://github.com/nomi-sec/PoC-in-GitHub
    - https://github.com/rezasarvani/JiraVulChecker
    - https://github.com/und3sc0n0c1d0/UserEnumJira
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2019-3403
    cwe-id: CWE-863
    epss-score: 0.53593
    epss-percentile: 0.99002
    cpe: cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: atlassian
    product: jira
    shodan-query:
      - http.component:"Atlassian Jira"
      - http.component:"atlassian jira"
      - http.component:"atlassian confluence"
      - cpe:"cpe:2.3:a:atlassian:jira"
  tags: cve,cve2019,atlassian,jira,enumeration,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/rest/api/2/user/picker?query="

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'contains(header, "application/json")'
          - 'contains_any(body, "\"users\":","\"usuario\":")'
          - 'contains_all(body, "\"total\":", "\"header\":")'
          - 'status_code == 200 || status_code == 404'
        condition: and

      - type: word
        part: body
        words:
          - 'total":0'
        negative: true

References

Use this check only on systems you are authorised to test. Where the data comes from