nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

How can you prevent Anonymous Users from conducting queries over the API using the picker function?

Security Researcher

The picker function in /rest/api/2/user/picker allows an anonymous user to conduct queries. If a valid username is queried, the application provides details about the user to include their email address.

The API documentation available here: https://docs.atlassian.com/software/jira/docs/api/REST/6.2/ states that this method cannot be accessed anonymously. Furthermore, the 'anyone' group has been removed from the 'Browse Users' permission in the global permissions, yet the issue persists.

Please assist in restricting the ability of the anonymous user to conduct picker queries through the API.

Accepted answers

All comments

Tom Lister_fo1j4e

Hi @Security Researcher

where is the anonymous access being performed as it should not be possible as stated.

however if you enter the rest call in a browser where you are logged into Jira then you will get a response. But it is not anonymous.

Security Researcher

Hi Tom,

The request can be performed through curl, web proxy, or even through the web browser. The responses are all the same and are done without authenticating to the application. In fact, when I review the response in burp it even has the following header ‘x-ausername: anonymous’

Tom Lister_fo1j4e

Hi @Security Researcher

The permission condition in the latest docs is

Permissions required: Browse users and groups global permission. Users with permission to access Jira can call this operation, but will only get search results for an exact name match.

Check what browse permissions are set to.

Are you cloud or server? Is your instance public?

Tom Lister_fo1j4e

I tried this on my server and it allowed anonymous as you said and I couldn’t find an option to prevent it. Some Rest apis are intended to allow anonymous access but the documentation suggests this one isn’t one of those.

maybe one for Atlassian support. Would probably fail most penetration tests for web apps.

I wondered whether it was my connected to my server being a service desk and related to allowing users without accounts to submit tickets.

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

server

jira

jira-server