CVE-2019-11581: Critical Template Injection Vulnerability in Atlassian Jira Server and Data Center
Vulnerability introduced nearly eight years ago could lead to remote code execution on vulnerable Jira Server and Data Center systems.
Background
On July 10, Atlassian published Security Advisory 2019-07-10 to address a critical vulnerability in Jira Server and Jira Data Center. Jira Server manages and controls Atlassian’s Jira ticketing system, while Jira Data Center allows administrators to manage business-wide management and scalability of Jira Servers.
Analysis
CVE-2019-11581 is a server-side template injection vulnerability in “various resources” of Jira Server and Data Center. According to the advisory, the vulnerability was introduced in version 4.4.0, which was released in August 2011, making this vulnerability nearly eight years old.
The template injection vulnerability exists within the ContactAdministrators and SendBulkMail actions in Jira Server and Data Center. However, in order to exploit the vulnerability, an SMTP server needs to be configured, and either the Contact Administrators Form needs to be enabled (unauthenticated attack), or the attacker has “JIRA Administrators” access (authenticated attack). Exploitation of this vulnerability would grant an attacker the ability to remotely execute code on the vulnerable Jira system.
Proof of concept
At the time of publishing, there was no proof of concept (PoC) available. However, similar to what transpired following the Atlassian advisory for the Confluence Widget Connector vulnerabilities (CVE-2019-3395, CVE-2019-3396) in March 2019, we anticipate that PoCs will emerge in the near future.
Solution
As noted in the Analysis section, CVE-2019-11581 was introduced in Jira Server and Data Center version 4.4.0. The patched versions that address this vulnerability include 8.0.3, 8.1.2, 8.2.3 and Enterprise releases 7.6.14 and 7.13.5. The following table lists the vulnerable versions and associated fixed versions.
| Affected Version | Fixed Version |
|---|---|
| 4.4.x | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 5.x.x | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 6.x.x | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.0.x | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.1.x | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.2.x | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.3.x | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.4.x | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.5.x | 7.6.14, 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.6.x before 7.6.14 | 7.6.14, 7.13.5 (Enterprise Releases) |
| 7.7.x | 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.8.x | 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.9.x | 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.10.x | 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.11.x | 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.12.x | 7.13.5, 8.0.3, 8.1.2, 8.2.3 |
| 7.13.x before 7.13.5 | 7.13.5 (Enterprise Release) |
| 8.0.x before 8.0.3 | 8.0.3 |
| 8.1.x before 8.1.2 | 8.1.2 |
| 8.2.x before 8.2.3 | 8.2.3 |
Atlassian also advises that customers who have installed Jira Service Desk version 3.0.0 before 4.2.3 may also be affected by this vulnerability. They have provided a compatibility matrix to help identify whether or not the Jira Service Desk version is affected.
Atlassian also notes that Jira Cloud customers are not affected by this vulnerability.
If upgrading to a patched version of Jira Server or Data Center is not currently feasible, Atlassian recommends the following temporary workarounds:
- First, disable the Contact Administrators Form
- Second, block access to the /secure/admin/SendBulkMail!default.jspa endpoint
Identifying affected systems
A list of Tenable plugins to identify this vulnerability will appear here as they’re released.
Additionally, Atlassian has provided a support document to help identify if an attacker has compromised a Jira instance using CVE-2019-11851.
Get more information
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.
Get a free 60-day trial of Tenable.io.
Related Articles
Volt Typhoon: What State and Local Government Officials Need to Know
November 19, 2024Increased activity from the state-sponsored threat group Volt Typhoon raises concerns about the cybersecurity of U.S. critical infrastructure. Here’s how you can identify potential exposures and attack paths.
Cybersecurity Snapshot: Guide Unpacks Event-Logging Best Practices, as FAA Proposes Stronger Cyber Rules for Airplanes
August 23, 2024Looking to sharpen your team’s event logging and threat detection? A new guide offers plenty of best practices. Plus, the FAA wants airplanes to be more resilient to cyberattacks. Meanwhile, check out the critical vulnerabilities Tenable discovered in two Microsoft AI products. And get the latest on ransomware trends, vulnerability management practices and election security!
Detecting Risky Third-party Drivers on Windows Assets
August 7, 2024Kernel-mode drivers are critical yet risky components of the Windows operating system. Learn about their functionality, the dangers they pose, and how Tenable's new plugins can help identify and mitigate vulnerabilities using community-driven resources like LOLDrivers.
Volt Typhoon: What State and Local Government Officials Need to Know
November 19, 2024Increased activity from the state-sponsored threat group Volt Typhoon raises concerns about the cybersecurity of U.S. critical infrastructure. Here’s how you can identify potential exposures and attack paths.
Volt Typhoon: U.S. Critical Infrastructure Targeted by State-Sponsored Actors
November 19, 2024Volt Typhoon, a state-sponsored actor linked to the People’s Republic of China, has consistently targeted U.S. critical infrastructure with the intent to maintain persistent access. Tenable Research examines the tactics, techniques and procedures of this threat actor.
CVE-2024-0012, CVE-2024-9474: Zero-Day Vulnerabilities in Palo Alto PAN-OS Exploited In The Wild
November 18, 2024Palo Alto Networks confirmed two zero-day vulnerabilities were exploited as part of attacks in the wild against PAN-OS devices, with one being attributed to Operation Lunar Peek.
- Threat Intelligence
- Threat Management
- Vulnerability Management
- Vulnerability Scanning