Scanner for “BlueKeep” vulnerability and newly minted exploits for Exim and Jira incorporated into cryptocurrency mining malware.

WatchBog Malware Adds BlueKeep Scanner (CVE-2019-0708), New Exploits (CVE-2019-10149, CVE-2019-11581)

Vulnerability introduced nearly eight years ago could lead to remote code execution on vulnerable Jira Server and Data Center systems.

CVE-2019-11581: Critical Template Injection Vulnerability in Atlassian Jira Server and Data Center

There was a server-side template injection vulnerability in Jira Server and Data Center, in the ContactAdministrators and the SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.

According to its self-reported version number, the version of Atlassian JIRA hosted on the remote web server is 4.4.x < 7.6.14, 7.7.x < 7.13.5, 8.0.x < 8.0.3, 8.1.x < 8.1.2, 8.2.x < 8.2.3. It is, therefore, affected by a server-side template injection vulnerability that exists in the ContactAdministrators and SendBulkMail actions where SMTP server is configured and the Contact Administrators Form is enabled. An unauthenticated, remote attacker may exploit this to bypass authentication and execute arbitrary code.

According to its self-reported version number, the Atlassian Jira application running on the remote host is 4.4.x < 7.6.14, 7.7.x < 7.13.5, 8.0.x < 8.0.3, 8.1.x < 8.1.2, 8.2.x < 8.2.3. It is, therefore, affected by a server-side template injection vulnerability that exists in the ContactAdministrators and SendBulkMail actions where SMTP server is configured and the Contact Administrators Form is enabled. An unauthenticated, remote attacker may exploit this to bypass authentication and execute arbitrary code.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of JIRA installed on the remote host is earlier than 7.6.x prior to 7.6.14, 7.13.x prior to 7.13.5, 8.0.x prior to 8.0.3, 8.1.x prior to 8.1.2 or 8.2.x prior to 8.2.3 and is affected by a Remote Code Execution (RCE) vulnerability. This vulnerability could allow a remote malicious user to execute arbitrary code on the system, caused by a server-side template injection vulnerability in various resources. If an SMTP server has been configured in Jira and the Contact Administrators Form is enabled or the attacker has "JIRA Administrators" access, an attacker could exploit this vulnerability to execute arbitrary code on the system.

According to its self-reported version number, the version of Atlassian JIRA hosted on the remote web server is 4.4.x < 7.6.14, 7.7.x < 7.13.5, 8.0.x < 8.0.3, 8.1.x < 8.1.2, 8.2.x < 8.2.3. It is, therefore, affected by a server-side template injection vulnerability that exists in the ContactAdministrators and SendBulkMail actions where SMTP server is configured and the Contact Administrators Form is enabled. An unauthenticated, remote attacker may exploit this to bypass authentication and execute arbitrary code.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
128762	Atlassian JIRA Server Template Injection Vulnerability (CVE-2019-11581)	Nessus	CGI abuses	critical
98655	Atlassian Jira 8.2.x < 8.2.3 Template Injection Vulnerability	Web App Scanning	Component Vulnerability	critical
98654	Atlassian Jira 8.1.x < 8.1.2 Template Injection Vulnerability	Web App Scanning	Component Vulnerability	critical
98653	Atlassian Jira 8.0.x < 8.0.3 Template Injection Vulnerability	Web App Scanning	Component Vulnerability	critical
98652	Atlassian Jira 7.7.x < 7.13.5 Template Injection Vulnerability	Web App Scanning	Component Vulnerability	critical
98651	Atlassian Jira 4.4.x < 7.6.14 Template Injection Vulnerability	Web App Scanning	Component Vulnerability	critical
700899	Atlassian JIRA 7.6.x < 7.6.14, 7.13.x < 7.13.5, 8.0.x < 8.0.3, 8.1.x < 8.1.2, 8.2.x < 8.2.3 RCE	Nessus Network Monitor	CGI	high
126620	Atlassian JIRA Server & JIRA Data Center Template Injection Vulnerability	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2019-11581

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

high

critical