Jira Service Desk Server and Jira Service Desk Data Center - Authorization Bypass allows information disclosure - CVE-2019-15003

Summary of Vulnerability

This advisory discloses two critical severity security vulnerabilities (CVE-2019-15003 and CVE-2019-15004) in Jira Service Desk Server and Jira Service Desk Data Center. Versions before 3.9.17, from 3.10.0 before 3.16.11, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and 4.5.0 before 4.5.1 are affected by these vulnerabilities.

Authorization bypass allows information disclosure - CVE-2019-15003

Severity

Atlassian rates the severity level of this vulnerability as critical, according to the scale published in our Atlassian severity levels. The scale allows us to rank the severity as critical, high, moderate or low.

This is our assessment and you should evaluate its applicability to your own IT environment.

Description

By design, Jira Service Desk gives customer portal users permissions only to raise requests and view issues. This allows users to interact with the customer portal without having direct access to Jira. These restrictions can be bypassed by any attacker with portal access* who exploits an authorization bypass. Exploitation allows an attacker to view all issues within all Jira projects contained in the vulnerable instance. This could include Jira Service Desk projects, Jira Core projects, and Jira Software projects.

All versions of Jira Service Desk before 3.9.17, from 3.10.0 before 3.16.11, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 are affected. This issue can be tracked here: https://jira.atlassian.com/browse/JSDSERVER-6590

 * Note that attackers can grant themselves access to Jira Service Desk portals that have the Anyone can email the service desk or raise a request in the portal setting enabled. Changing this permission does not remove the vulnerability to an exploit by an attacker that has portal access. Atlassian does not recommend changing the permission, instead please read-on and follow the instructions outlined in the section:

Acknowledgements

We would like to acknowledge Raphaël Arrouas for discovering this vulnerability.

Mitigation

If you are unable to upgrade Jira Service Desk immediately or are in the process of migrating to Jira Cloud, then as a temporary workaround, you can:

• Block requests to Jira containing jspa, jpsx, jsp at the reverse proxy or load balance level, or

• Alternatively, configure Jira to redirect requests containing jspa, jspx, jsp to a safe URL
  

  • Add the following to the <urlrewrite> section of [jira-installation-directory]/atlassian-jira/WEB-INF/urlrewrite.xml:

    <rule>
        <from>/servicedesk/.*\.jsp.*</from>
        <to type="temporary-redirect">/</to>
    </rule>

  • After saving the changes above, restart Jira

After upgrading Jira Service Desk this mitigation can be removed.

URL path traversal allows information disclosure - CVE-2019-15004

Severity

Atlassian rates the severity level of this vulnerability as critical, according to the scale published in our Atlassian severity levels. The scale allows us to rank the severity as critical, high, moderate or low.

This is our assessment and you should evaluate its applicability to your own IT environment.

Description

By design, Jira Service Desk gives customer portal users permissions only to raise requests and view issues. This allows users to interact with the customer portal without having direct access to Jira. These restrictions can be bypassed by any attacker with portal access* who exploits a path traversal vulnerability. Exploitation allows an attacker to view all issues within all Jira projects contained in the vulnerable instance. This could include Jira Service Desk projects, Jira Core projects, and Jira Software projects.

All versions of Jira Service Desk before 3.9.17, from 3.10.0 before 3.16.11, from 4.0.0 before 4.2.6, from 4.3.0 before 4.3.5, from 4.4.0 before 4.4.3, and from 4.5.0 before 4.5.1 are affected. This issue can be tracked here: https://jira.atlassian.com/browse/JSDSERVER-6589

* Note that attackers can grant themselves access to Jira Service Desk portals that have the Anyone can email the service desk or raise a request in the portal setting enabled. Changing this permission does not remove the vulnerability to an exploit by an attacker that has portal access. Atlassian does not recommend changing the permission, instead please read-on and follow the instructions outlined in the section:

Acknowledgements

We would like to acknowledge Raphaël Arrouas for discovering this vulnerability.

Mitigation

If you are unable to upgrade Jira Service Desk immediately or are in the process of migrating to Jira Cloud, then as a temporary workaround, you can:

• Block requests to Jira containing .. at the reverse proxy or load balance level, or
• Alternatively, configure Jira to redirect requests containing .. to a safe URL

  • Add the following to the <urlrewrite> section of [jira-installation-directory]/atlassian-jira/WEB-INF/urlrewrite.xml:

        <rule>
            <from>^/.*\.\..*$</from>
            <to type="temporary-redirect">/</to>
        </rule>

  • After saving the changes above, restart Jira

After upgrading Jira Service Desk this mitigation can be removed.

Fix

We have released the following versions of Jira Service Desk Server & Jira Service Desk Data Center to address these issues:

• 4.5.1 can be downloaded from https://www.atlassian.com/software/jira/service-desk/update
• 4.4.3 which can be downloaded from https://www.atlassian.com/software/jira/service-desk/update
• 4.3.5 which can be downloaded from https://www.atlassian.com/software/jira/service-desk/update
• 4.2.6 which can be downloaded from https://www.atlassian.com/software/jira/service-desk/update
• 3.16.11 which can be downloaded from https://www.atlassian.com/software/jira/service-desk/update
• 3.9.17 which can be downloaded from https://www.atlassian.com/software/jira/service-desk/update

What You Need to Do

Upgrading Jira Service Desk

Atlassian recommends that you upgrade to the latest version. For a full description of the latest version of Jira Service Desk Server & Jira Service Desk Data Center, see the Release Notes. You can download the latest version of Jira Service Desk Server & Jira Service Desk Data Center from the Download Center.

Upgrading Jira Service Desk also requires upgrading Jira Core. Check the compatibility matrix to find the equivalent version for your Jira Service Desk version.

Support

If you did not receive an email for this advisory and you wish to receive such emails in the future, go to https://my.atlassian.com/email and subscribe to the Alerts emails.

If you have questions or concerns regarding this advisory, please raise a support request at https://support.atlassian.com/.

References