#%NASL_MIN_LEVEL 70300 # # (C) Tenable Network Security, Inc. # include('deprecated_nasl_level.inc'); include('compat.inc'); if (description) { script_id(48263); script_version("1.17"); script_set_attribute(attribute:"plugin_modification_date", value:"2025/05/14"); script_bugtraq_id(42025); script_name(english:"Atlassian JIRA ConfigureReport.jspa 'reportKey' Information Disclosure"); script_set_attribute(attribute:"synopsis", value: "The remote web server hosts a web application that is affected by an information disclosure vulnerability."); script_set_attribute(attribute:"description", value: "The Atlassian JIRA installation hosted on the remote web server is affected by an information disclosure vulnerability, which an unauthenticated attacker can exploit, by setting the 'reportKey' parameter in ConfigureReport.jspa to an invalid value, to gain access to sensitive information, such as operating system version, database version, or build version from the remote system. This version of JIRA is also reportedly affected by multiple cross-site scripting vulnerabilities; however, Nessus has not tested for these issues."); script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2010/Jul/254"); script_set_attribute(attribute:"see_also", value:"https://id.atlassian.com/login?continue=https%3A%2F%2Fid.atlassian.com%2Fopenid%2Fv2%2Fop%3Fopenid.return_to%3Dhttps%3A%2F%2Fconfluence.atlassian.com%2Fplugins%2Fservlet%2Fauthentication%3Fauth_plugin_original_url%253D%25252Fjirakb%25252Fremove-information-from-the-500-error-page-oops-an-error-has-occurred-282174657.html%26openid.ns%3Dhttp%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%26openid.ns.sreg%3Dhttp%3A%2F%2Fopenid.net%2Fsreg%2F1.0%26openid.assoc_handle%3D11685648%26openid.identity%3Dhttp%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select%26openid.realm%3Dhttps%3A%2F%2F*.atlassian.com%26openid.claimed_id%3Dhttp%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select%26openid.sreg.required%3Dfullname%2Cnickname%2Cemail%26openid.mode%3Dcheckid_setup&prompt=&application=&tenant=&email=&errorCode="); script_set_attribute(attribute:"solution", value: "Modify the JIRA 500 error page as discussed in the vendor's knowledge base article."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N"); script_set_cvss_temporal_vector("CVSS2#E:F/RL:U/RC:ND"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploited_by_nessus", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2010/07/24"); script_set_attribute(attribute:"plugin_publication_date", value:"2010/08/06"); script_set_attribute(attribute:"plugin_type", value:"remote"); script_set_attribute(attribute:"cpe", value:"cpe:/a:atlassian:jira"); script_set_attribute(attribute:"thorough_tests", value:"true"); script_set_attribute(attribute:"enable_cgi_scanning", value:"true"); script_end_attributes(); script_category(ACT_ATTACK); script_family(english:"CGI abuses"); script_copyright(english:"This script is Copyright (C) 2010-2025 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("jira_detect.nasl"); script_require_keys("installed_sw/Atlassian JIRA"); script_require_ports("Services/www", 8080); exit(0); } include("audit.inc"); include("global_settings.inc"); include("misc_func.inc"); include("http.inc"); include("install_func.inc"); include("data_protection.inc"); app = "Atlassian JIRA"; get_install_count(app_name:app, exit_if_zero:TRUE); port = get_http_port(default:8080); install = get_single_install( app_name : app, port : port ); dir = install['path']; # Try to find a valid id. start = 10000; if (thorough_tests) end = 10100; else end = 10040; pid = ''; for (i = start ; i < end ; i+=10) { url = dir + "/ViewProject.jspa?pid="+i; res = http_send_recv3(method:"GET", item:url, port:port, exit_on_fail:TRUE); if ( ( "You cannot view this URL as a guest." >< res[2] || ">Project Category:<" >< res[2] || ">Project Team:<" >< res[2] ) && "There is not a project with the specified id" >!< res[2] ) { pid = i; break; } } # In some testing cases, the project id was not needed so test anyways if (!pid) pid = '1000'; url = "/ConfigureReport.jspa?selectedProjectId="+pid+"&reportKey="+SCRIPT_NAME+'-'+unixtime()+"&Next=Next"; res = http_send_recv3(method:"GET", item:dir+url, port:port, exit_on_fail:TRUE); # Look for strings that indicate information disclosure... if( ">Oops - an error has occurred<" >< res[2] && ">System Information:" >< res[2] && ">Build Information:" >< res[2] ) { out = strstr(res[2], "Build Information:"); if (!empty_or_null(out)) { foreach line (split(out, sep:"
", keep:FALSE)) if (line =~ "^[a-zA-Z0-9. :]+$") output += line + '\n'; } else output = res[2]; security_report_v4( port : port, severity : SECURITY_WARNING, generic : TRUE, request : make_list(build_url(qs:dir+url, port:port)), output : data_protection::sanitize_user_full_redaction(output:chomp(output)) ); } else audit(AUDIT_WEB_APP_NOT_AFFECTED, app, build_url(qs:dir, port:port));

Query Builder