Atlassian Jira Issue Key Information Disclosure Vulnerability

Summary

An issue key information disclosure vulnerability exists in Atlassian Jira, from versions 7.6.4 to 8.1.0. Anonymous users can differentiate between valid issue keys and invalid issue keys via the /rest/api/1.0/render API endpoint.

Tested Versions

Atlassian Jira 7.6.4 Atlassian Jira 8.1.0

Product URLs

<https://www.atlassian.com/software/jira&gt;

CVSSv3 Score

5.3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-862 - Missing Authorization

Details

An attacker can use this vector to identify valid issues. This does not require a valid session.

Exploit Proof-of-Concept

Submit a POST to /rest/api/1.0/render with the following body:

{"rendererType":"atlassian-wiki-renderer",
 "unrenderedMarkup":"!any_non_valid_attachment_name!",
 "issueKey":"<ISSUE-KEY>"}

replacing <ISSUE-KEY> with a possibly valid issue key.

A response containing “No usable issue stored in the context…” indicates the issue-key is not valid.

A response containing “Unable to render embedded object…” indicates the issue-key is valid.

Timeline

2019-05-14 - Vendor Disclosure
2019-09-09 - Vendor Patched
2019-09-16 - Public Release