CVE-2019-11581: Vulnerabilidade para injeção crítica de modelo no servidor e datacenter Atlassian Jira
Vulnerability introduced nearly eight years ago could lead to remote code execution on vulnerable Jira Server and Data Center systems.
Contexto
On July 10, Atlassian published Security Advisory 2019-07-10 to address a critical vulnerability in Jira Server and Jira Data Center. Jira Server manages and controls Atlassian’s Jira ticketing system, while Jira Data Center allows administrators to manage business-wide management and scalability of Jira Servers.
Análise
CVE-2019-11581 is a server-side template injection vulnerability in “various resources” of Jira Server and Data Center. According to the advisory, the vulnerability was introduced in version 4.4.0, which was released in August 2011, making this vulnerability nearly eight years old.
The template injection vulnerability exists within the ContactAdministrators and SendBulkMail actions in Jira Server and Data Center. However, in order to exploit the vulnerability, an SMTP server needs to be configured, and either the Contact Administrators Form needs to be enabled (unauthenticated attack), or the attacker has “JIRA Administrators” access (authenticated attack). Exploitation of this vulnerability would grant an attacker the ability to remotely execute code on the vulnerable Jira system.
Prova de conceito
At the time of publishing, there was no proof of concept (PoC) available. However, similar to what transpired following the Atlassian advisory for the Confluence Widget Connector vulnerabilities (CVE-2019-3395, CVE-2019-3396) in March 2019, we anticipate that PoCs will emerge in the near future.
Solução
As noted in the Analysis section, CVE-2019-11581 was introduced in Jira Server and Data Center version 4.4.0. The patched versions that address this vulnerability include 8.0.3, 8.1.2, 8.2.3 and Enterprise releases 7.6.14 and 7.13.5. The following table lists the vulnerable versions and associated fixed versions.
| Affected Version | Fixed Version |
|---|---|
| 4.4.x | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 5.x.x | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 6.x.x | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.0.x | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.1.x | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.2.x | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.3.x | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.4.x | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.5.x | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.6.x before 7.6.14 | 7.6.14, 7.13.5 (Enterprise Releases) |
| 7.7.x | 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.8.x | 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.9.x | 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.10.x | 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.11.x | 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.12.x | 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.13.x before 7.13.5 | 7.13.5 (Enterprise Release) |
| 8.0.x before 8.0.3 | 8.0.3 |
| 8.1.x before 8.1.2 | 8.1.2 |
| 8.2.x before 8.2.3 | 8.2.3 |
Atlassian also advises that customers who have installed Jira Service Desk version 3.0.0 before 4.2.3 may also be affected by this vulnerability. They have provided a compatibility matrix to help identify whether or not the Jira Service Desk version is affected.
Atlassian also notes that Jira Cloud customers are not affected by this vulnerability.
If upgrading to a patched version of Jira Server or Data Center is not currently feasible, Atlassian recommends the following temporary workarounds:
- First, disable the Contact Administrators Form
- Second, block access to the /secure/admin/SendBulkMail!default.jspa endpoint
Identificação de sistemas afetados
A list of Tenable plugins to identify this vulnerability will appear here as they’re released.
Additionally, Atlassian has provided a support document to help identify if an attacker has compromised a Jira instance using CVE-2019-11851.
Obtenha mais informações
Junte-se à equipe de resposta de segurança da Tenable na Tenable.
Saiba mais sobre a Tenable, a primeira plataforma de Cyber Exposure para o gerenciamento holístico da sua superfície de ataque moderna.
Get a free 60-day trial of Tenable.io.
Artigos relacionados
Cybersecurity Snapshot: Find MITRE ATT&CK Complex? Need Help Mapping to It? There’s an App for That!
March 10, 2023Learn about a new tool that streamlines MITRE ATT&CK mapping. Plus, known vulnerabilities remain a major cyber risk – just ask LastPass. Also, discover why SaaS data protection remains difficult. Plus, a look at the U.S. National Cybersecurity Strategy. And much more!
The Ransomware Ecosystem: In Pursuit of Fame and Fortune
July 28, 2022The key players within the ransomware ecosystem, including affiliates and initial access brokers, work together cohesively like a band of musicians, playing their respective parts as they strive for fame and fortune.
Brazen, Unsophisticated and Illogical: Understanding the LAPSUS$ Extortion Group
July 20, 2022Having gained the industry’s attention in the first months of 2022, the LAPSUS$ extortion group has largely gone quiet. What can we learn from this extortion group’s story and tactics?
CVE-2024-4040: CrushFTP Virtual File System (VFS) Sandbox Escape Vulnerability Exploited
April 23, 2024A zero-day vulnerability in CrushFTP was exploited in the wild against multiple U.S. entities prior to fixed versions becoming available as the vendor recommends customers upgrade as soon as possible.
Operational Technology in the DoD: Ensuring a Secure and Efficient Power Grid
April 19, 2024In an evolving threat landscape, the DoD must make sure that its mission-critical operations don’t experience power outages.
Cybersecurity Snapshot: Cyber Agencies Offer Secure AI Tips, while Stanford Issues In-Depth AI Trends Analysis, Including of AI Security
April 19, 2024Check out recommendations for securing AI systems from the Five Eyes cybersecurity agencies. Plus, Stanford University offers a comprehensive review of AI trends. Meanwhile, a new open-source tool aims to simplify SBOM usage. And don’t miss the latest CIS Benchmarks updates. And much more!
- Threat Intelligence
- Threat Management
- Vulnerability Management
- Vulnerability Scanning