exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Jira / HipChat For Jira Java Code Execution

Jira / HipChat For Jira Java Code Execution
Posted Sep 2, 2015
Authored by David Black

It was discovered that the HipChat For JIRA plugin had a resource that combined user input into a velocity template source and subsequently rendered it. Authenticated attackers can use this vulnerability to execute Java code of their choice on systems that have a vulnerable version of the HipChat For JIRA plugin enabled. To exploit this issue attackers need to be able to access the JIRA web interface and log into JIRA. All versions of JIRA from 6.3.5 before 6.4.11 are affected by this vulnerability. All versions of HipChat For JIRA plugin from 1.3.2 before 6.30.0 are affected by this vulnerability.

tags | advisory, java, web
advisories | CVE-2015-5603
SHA-256 | 83c334c08327df0dc9754cc92b35813430f7bacb3e42061816848445100e76f0

Jira / HipChat For Jira Java Code Execution

Change Mirror Download
Note: the current version of this advisory can be found at
https://confluence.atlassian.com/x/IcBKLg .

CVE ID: CVE-2015-5603
Product: JIRA and the HipChat for JIRA plugin.
Affected HipChat For JIRA plugin versions: 1.3.2 <= version < 6.30.0
Affected JIRA product versions: 6.3.5 <= version < 6.4.11


Summary:
This advisory discloses a critical severity security vulnerability
that was introduced in version 1.3.2 of the HipChat for JIRA plugin.
Versions of the HipChat for JIRA plugin starting with 1.3.2 before
6.30.0 (the fixed version) are vulnerable. Vulnerable versions of the
HipChat for JIRA plugin were bundled by default with JIRA since JIRA
version 6.3.5, up to but not including 6.4.11 (the fixed version).

Atlassian Cloud instances have already been upgraded to a version of
the HipChat for JIRA plugin which does not have the issue described in
this email.

Customers who have updated the HipChat For JIRA plugin to version
6.30.0 or higher are not affected.

Customers who have downloaded and installed JIRA >= 6.3.5 < 6.4.11
and have not updated the HipChat For JIRA plugin to 6.30.0 or higher
should either update those instances of the HipChat For JIRA plugin
for their JIRA installations in order to fix this vulnerability.

Customers who have installed the HipChat For JIRA plugin in JIRA, and
are running a version of the plugin equal to or above 1.3.2 and less
than 6.30.0 should either update those instances of the HipChat For
JIRA plugin or their JIRA installations to fix this vulnerability.


Severity:
Atlassian rates the severity level of this vulnerability as critical,
according to the scale published in our Atlassian severity levels
(https://www.atlassian.com/security/security-severity-levels). The
scale allows us to rank a severity as critical, high, moderate, or
low.
This is an independent assessment and you should evaluate its
applicability to your own IT environment.


Description:
We internally discovered that the HipChat For JIRA plugin had a
resource that combined user input into a velocity template source and
subsequently rendered it. Authenticated attackers can use this
vulnerability to execute Java code of their choice on systems that
have a vulnerable version of the HipChat For JIRA plugin enabled. To
exploit this issue attackers need to be able to access the JIRA web
interface and log into JIRA.

All versions of HipChat For JIRA plugin from 1.3.2 before 6.30.0 are
affected by this vulnerability.

All versions of JIRA from 6.3.5 before 6.4.11 are affected by this
vulnerability. This issue can be tracked here:
https://jira.atlassian.com/browse/JRA-44831


Fix:
We have taken the follow steps to address this issue:
Released a new version, 6.30.0, of the HipChat For JIRA plugin
Released JIRA version 6.4.11 that updates the bundled copy of the
HipChat For JIRA plugin to a fixed version.


Remediation:
Upgrade the HipChat for JIRA plugin to version 6.30.0 or higher. For
instructions on how to update add-ons like the HipChat For JIRA plugin
see https://confluence.atlassian.com/display/UPM/Updating+add-ons.
Optionally upgrade JIRA to version 6.4.11 which bundles a fixed
version of the HipChat For JIRA plugin.


Risk Mitigation:
If you are unable to upgrade your JIRA server or the HipChat for JIRA
plugin, then as a temporary workaround, you can disable or uninstall
the HipChat For JIRA plugin in JIRA.


Support:
If you have questions or concerns regarding this advisory, please
raise a support request at https://support.atlassian.com/ .

--
David Black / Security Engineer.
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close