Vulnerabilities in application Links

[Srinath Reddy Pinappu]

• Description

  Multiple vulnerabilities have been reported in Atlassian JIRA, which can be exploited by malicious people to
  conduct cross-site request forgery attacks and bypass certain security restrictions.
  1) The application allows users to perform certain actions via HTTP requests without performing proper validity
  checks to verify the requests. This can be exploited to conduct certain actions when a logged-in user visits a
  specially crafted web page.
  2) An error related to the /plugins/servlet/gadgets/makeRequest resource can be exploited to perform
  otherwise restricted server-side requests.

  Sources:
  Atlassian: https://conuence.atlassian.com/jirasoftware/jira-software-8-7-x-release-notes-990550432.html
  Atlassian: https://jira.atlassian.com/browse/JRASERVER-70607
  Atlassian: https://jira.atlassian.com/browse/JRASERVER-70606
  Atlassian: https://jira.atlassian.com/browse/JRASERVER-70605
  Atlassian: https://jira.atlassian.com/browse/JRASERVER-71204
  Tenable: https://www.tenable.com/security/research/tra-2020-05

  Currently we are on 8.1 version, what do you suggest we do to address the above vulnerabilities. we see these vulnerabilities are not see in versions above 8.7.0, but would like to know keeping the same version(8.1) how can we or can we address it?

[M Amine]

OffCourse the easiest way is to upgrade. If not, every workaround will ask for some effort in order to test it. Which is not easy to do too.

A workaround would be for example : adding a reverse-proxy and blocking URI/URL and having more security and filtering rules between servers...etc. But this solution :

1. Has to be implemented
2. Tested
3. Deployed