Feedback about Security Vulnerability API

[Tim Eddelbüttel]

First of all the Vulnerability portal (https://www.atlassian.com/trust/data-protection/vulnerabilities) is a great starting point to keep track of vulnerabilities.

Recently I've played around with the Security Vulnerability API (https://developer.atlassian.com/platform/security-vulnerability-api/). Mainly put them into Assets / Insight.

Here is some feedback / questions / improvements for the API that come to my mind:

• Entries should have a technical ID for further processing the correct entries. At the moment I've used cve_id and atl_tracking_url to identify unique entries. In the example the same CVE has two BAM issues with different summaries. So the CVE itself is also not unique for a product
  Example:
  • https://api.atlassian.com/vuln-transparency/v1/cves?cve_ids=CVE-2023-28709&products=Bamboo+Data+Center%2CBamboo+Server
  • https://jira.atlassian.com/browse/CONFSERVER-91258
    Looking at issue history the CVE ID has changed from CVE-2023-22512 to CVE-2024-21679
    
• CVE details output format (https://developer.atlassian.com/platform/security-vulnerability-api/rest/api-group-cves/#api-group-cves) can the specified as html, plaintext and adf. Can someone update the API documentation?
  Example: https://api.atlassian.com/vuln-transparency/v1/cves?format=html&cve_ids=CVE-2022-1471
  returns "400_BAD_REQUEST invalid format: html".
  Also adf works only in small letters and plaintext works only as text.
• Jira Core Data Center isn't a product / license that exists as of today :)
• affected_products contains just the Marketing names. It would be great to also have the application / product keys propogated to a separate attribute that are used in the Marketplace API (https://developer.atlassian.com/platform/marketplace/rest/v2) instead of only human readable names.
• affected_products not always accurate looking at CVE-2023-42794 (https://jira.atlassian.com/browse/JSWSERVER-25400) if the problem itself is in Apache Tomcat, then Jira Core and Jira Service Management are also affected by this. Not sure how I would solve this because technically it doesn't matter... Server / Data Center is the same deployment package and Jira Software & Jira Service Management are technically still apps just bundled into a single deployment that runs on Jira "Core without bundled products". As JSW and JSM updates are distributed only with Jira Core, Jira Core should be always an affected application. But might be different again when e.g. the problem is in Assets, Advanced Roadmaps, Automation for Jira or any other bundled app.
• Getting the affected & fixed versions isn't perfect...
  Example: https://api.atlassian.com/vuln-transparency/v1/products?products=Bamboo%20Server%2CBamboo%20Data%20Center&cve_ids=CVE-2023-28709
  Remember I filtered for a specific CVE for a product...
  
  I'll have the feeling after looking at https://www.atlassian.com/trust/data-protection/vulnerabilities that it's mixed up with Confluence in the response also it wasn't requested?
• Having a vulnerability type attribute (e.g. overflow, memory corruption, SQL injection, etc) would be nice for further filtering

Little feedback for the portal itself:

• Ability to directly link to a vulnerability

And in general it would be great if there would be an initiative to also open this to app vendors maybe as part of the Marketplace Security Bug Bounty Program.

Kind Regards,
Tim

[Tim Eddelbüttel]

@Lee Berg, Feedback would be still appropriate ;)

New "issue" discovered, for whatever reason when you query the CVEs endpoint for "Jira Software Data Center" the result is HTTP 200 OK but without any response. Sometimes I also get a HTTP 504 Gateway Timeout.

Usually I'll fetch all Jira "products" at once:

https://api.atlassian.com/vuln-transparency/v1/cves?products=Jira%20Core%20Server%2CJira%20Core%20Data%20Center%2CJira%20Software%20Server%2CJira%20Software%20Data%20Center%2CJira%20Service%20Management%20Server%2CJira%20Service%20Management%20Data%20Center

Separating these shows that Jira Software Data Center is "problematic" for whatever reason.

https://api.atlassian.com/vuln-transparency/v1/cves?products=Jira Core Server
https://api.atlassian.com/vuln-transparency/v1/cves?products=Jira Core Data Center
https://api.atlassian.com/vuln-transparency/v1/cves?products=Jira Software Server
https://api.atlassian.com/vuln-transparency/v1/cves?products=Jira Software Data Center
https://api.atlassian.com/vuln-transparency/v1/cves?products=Jira Service Management Server
https://api.atlassian.com/vuln-transparency/v1/cves?products=Jira Service Management Data Center

Where to report such issues?

Kind Regards,
Tim

[Tim Eddelbüttel]

Hi @Lee Berg

I saw your post on https://community.atlassian.com/t5/Trust-Security-articles/Mark-Your-Calendars-Introducing-Monthly-Security-Disclosures/ba-p/2446575 and I hope as Product Manager Security the above feedback is interesting for you :)

Regards,
Tim