Skip to content
Permalink
main
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Go to file
 
 
Cannot retrieve contributors at this time

Overview

Stagil navigation for jira – Menù & Themes" is a Jira GUI customization plugin that allows, among other things, to insert a custom image as a header and/or footer. This plugin was developed by Stagil, an independent company that is a Silver Solution Partner and focuses on designing efficient and durable plugin solutions for the Jira environment.

Vulnerability Description

Prior to version 2.0.52 of the “Stagil navigation for jira – Menù & Themes", the fileName parameter is vulnerable to a "Directory Traversal" that would allow an attacker to read files on the server knowing their path.

Directory Traversal is a vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application data, credentials for back-end systems, and sensitive operating system files.

The CVE Program has assigned the ID CVE-2023-20255 to this issue. This is a record on the CVE List, which standardizes names for security problems:

CVE ID: CVE-2023-26255 --> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26255

Impacts

This vulnerability allows an attacker to take files on the server and download them locally. Configuration files containing plaintext passwords can also be retrieved, as well as application logs to conduct analysis on users browsing the site.

CVE-2023-26255 - Directory Traversal

Proof of concept (POC)

Reproducing Steps

First you need to have the “Stagil navigation for jira – Menù & Themes v2.0.50” plugin installed, which can be downloaded from the atlassian marketplace.

You can check your "Menù & Themes" version in admin panel:

2023-02-28 12_53_05-kali-linux-2022 3-vmware-amd64 - VMware Workstation

Once you have customized the Jira GUI and added a new image as the navigation bar background, you can exploit the vulnerability in question.

2022-10-06 10_35_14-Window

Once the image has been loaded whenever you navigate a project menu an HTTP GET request is made that invokes that image.

This request use two paramenters: “fileName” and “fileMime”, the former being vulnerable to Path Traversal since no type of check is done on the content of this parameter.

In fact, it is possible to insert a payload, consisting of the path we want to retrieve, inside "fileName" to get the contents of the retrieved file as the following images show:

2022-10-06 10_50_46-Window

GET /plugins/servlet/snjCustomDesignConfig?fileName=../../../../etc/passwd&fileMime=$textMime  HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

Moreover, this request can be made even without being authenticated, in fact in the next evidence the request is made without session cookies:

2022-10-06 10_54_35-Window

Suggestions

To make the fix for this vulnerability, it is recommended to update the plugin to version 2.0.52 where this issue is no longer present.

Discovered by

Alessandro Fondacci of Cybertech srl