Atlassian Jira Service Management Data Center and Server 5.17.0 < 10.3.25 / 10.4.x < 11.3.10 (JSDSERVER-16742)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(347982);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/09/18");

  script_cve_id("CVE-2026-54512");
  script_xref(name:"IAVA", value:"2026-A-1023");

  script_name(english:"Atlassian Jira Service Management Data Center and Server 5.17.0 < 10.3.25 / 10.4.x < 11.3.10 (JSDSERVER-16742)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Atlassian Jira Service Management Data Center and Server (Jira Service Desk) host is missing a security
update.");
  script_set_attribute(attribute:"description", value:
"The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host
is affected by a vulnerability as referenced in the JSDSERVER-16742 advisory.

  - jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data
    Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV)
    is the primary safety mechanism guarding polymorphic deserialization. When polymorphic typing is enabled
    and a type identifier contains generic parameters (i.e. the type ID string contains <),
    DatabindContext._resolveAndValidateGeneric() validates only the raw container class name (the substring
    before <) against the configured PTV. If the container type is approved, the method parses the full
    canonical type string via TypeFactory.constructFromCanonical() and returns the fully parameterized type
    without ever validating the nested type arguments against the PTV. The nested type arguments are then
    resolved, instantiated, and populated as beans during deserialization. An attacker who controls the type
    ID can therefore place a denied class as a generic type parameter of an allowed container  for example
    java.util.ArrayList<com.evil.Gadget> when only java.util.ArrayList is allow-listed. The container passes
    the PTV check; com.evil.Gadget is loaded via Class.forName(name, true, loader), instantiated, and its
    properties are set from attacker-controlled JSON. This completely bypasses an explicitly configured PTV
    allow-list. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4. (CVE-2026-54512)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://jira.atlassian.com/browse/JSDSERVER-16742");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Atlassian Jira Service Management Data Center and Server version 10.3.25, 11.3.10 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-54512");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/09/01");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:atlassian:jira_service_desk");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("jira_service_desk_installed_win.nbin", "jira_service_desk_installed_nix.nbin");
  script_require_keys("installed_sw/JIRA Service Desk Application");

  exit(0);
}

include('vdf.inc');

# @tvdl-content-verify-only
var vuln_data = {
  "metadata": {
    "spec_version": "1.0"
  },
  "checks": [
    {
      "product": {
        "name": "JIRA Service Desk Application",
        "type": "app"
      },
      "check_algorithm": "default",
      "constraints": [
        { "min_version": "5.17.0", "fixed_version": "10.3.25" },
        { "min_version": "10.4.0", "fixed_version": "11.3.10" }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);