Skip to content
Nuclei Templates

Atlassian Jira Server-Side Template Injection

ID: CVE-2019-11581

Severity: critical

Author: ree4pwn

Tags: cve,cve2019,atlassian,jira,ssti,rce,kev

Description

Section titled “Description”

Jira Server and Data Center is susceptible to a server-side template injection vulnerability via the ContactAdministrators and SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.

YAML Source

Section titled “YAML Source”
id: CVE-2019-11581


info:
  name: Atlassian Jira Server-Side Template Injection
  author: ree4pwn
  severity: critical
  description: Jira Server and Data Center is susceptible to a server-side template injection vulnerability via the ContactAdministrators and SendBulkMail actions. An attacker is able to remotely execute code on systems that run a vulnerable version of Jira Server or Data Center. All versions of Jira Server and Data Center from 4.4.0 before 7.6.14, from 7.7.0 before 7.13.5, from 8.0.0 before 8.0.3, from 8.1.0 before 8.1.2, and from 8.2.0 before 8.2.3 are affected by this vulnerability.
  impact: |
    Successful exploitation of this vulnerability can lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system.
  remediation: |
    Apply the necessary security patches or upgrade to a fixed version provided by Atlassian to mitigate this vulnerability.
  reference:
    - https://github.com/jas502n/CVE-2019-11581
    - https://jira.atlassian.com/browse/JRASERVER-69532
    - https://nvd.nist.gov/vuln/detail/CVE-2019-11581
    - https://github.com/0x48piraj/jiraffe
    - https://github.com/bakery312/Vulhub-Reproduce
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2019-11581
    cwe-id: CWE-74
    epss-score: 0.9725
    epss-percentile: 0.99846
    cpe: cpe:2.3:a:atlassian:jira:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: atlassian
    product: jira
    shodan-query:
      - http.component:"Atlassian Jira"
      - http.component:"atlassian jira"
      - http.component:"atlassian confluence"
      - cpe:"cpe:2.3:a:atlassian:jira"
  tags: cve,cve2019,atlassian,jira,ssti,rce,kev


http:
  - method: GET
    path:
      - "{{BaseURL}}/secure/ContactAdministrators!default.jspa"


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Contact Site Administrators"


      - type: word
        part: body
        negative: true
        words:
          - "has not yet configured this contact form"


      - type: regex
        part: body
        regex:
          - "\\(v4\\.4\\."
          - "\\(v5\\."
          - "\\(v6\\."
          - "\\(v7\\.[012345789]\\."
          - "\\(v7\\.1[0-2]\\."
          - "\\(v7\\.6\\.([0-9]|[1][0-3])"
          - "\\(v7\\.\\13\\.[0-4]"
          - "\\(v8\\.0\\.[0-2]"
          - "\\(v8\\.1\\.[0-1]"
          - "\\(v8\\.2\\.[0-2]"
        condition: or
# digest: 4a0a00473045022055131c413bc28f04a7d1da237e42ede6aba7b730941322eabd5ccfbfb06ce674022100bf5e31898995864b0a258c7541179d1de21dede7977122a105e143e69c545bf9:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2019/CVE-2019-11581.yaml"

View on Github