Sendbulkmail endpoint in JIRA

Question

Hi,

We received the email from Atlassian about the vulnerability and we are unable to upgrade our version right away.

We have disabled the Contact Administrators Form option in settings as a quick work around.

But we are unsure if we run on Apache Tomcat. Assuming we don't, where do we disable the sendbulkmail endpoint.

Pangeel Shubha · Answer

Thanks @Andy Heinzer . I am one of the Jira Administrators for configurations. The installation and others were done by another teammate who is not part of the team now.

Shall try to investigate further about Tomcat and modify accordingly. Thanks again.

Andy Heinzer · Answer

Hi Pangeel,

All versions of Jira Server and Data Center bundle with them an Apache Tomcat webserver.

This is a java based webserver that hosts Jira's website.  You might also have a reverse proxy or a load balancer in front of Jira that might be passing traffic to Tomcat, but you must have Tomcat * (unless of course you are running a really old version of Jira WAR, which could in theory be deployed to some other kind of web server container, but I doubt this since Atlassian has not supported these for a few years now).

To that end, it's possible you could block access to this in your proxy/load balancer, but it's probably best to do so in Tomcat, in case you have any internal traffic that can reach your Jira site without having to pass through the proxy.

However since that part of this advisory is only exploitable by users with Jira Administrator rights, it feels like that part of this mitigation is far less a priority if you trust your administrators.

I hope this helps.

Andy

Tinker Fadoua · Answer

@Pangeel Shubha

Did you try the following steps:

https://confluence.atlassian.com/kb/how-to-block-access-to-a-specific-url-at-tomcat-966668691.html

Best,

Fadoua