Workaround for CVE-2019-14994

お困りですか?

アトラシアン コミュニティをご利用ください。

コミュニティに質問

プラットフォームについて: Server および Data Center のみ。この記事は、Server および Data Center プラットフォームのアトラシアン製品にのみ適用されます。

Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.

*Fisheye および Crucible は除く

Platform Notice: Server, Data Center, and Cloud By Request - This article was written for the Atlassian server and data center platforms but may also be useful for Atlassian Cloud customers. If completing instructions in this article would help you, please contact Atlassian Support and mention it.

Support for Server* products ended on February 15th 2024. If you are running a Server product, you can visit the Atlassian Server end of support announcement to review your migration options.

*Fisheye および Crucible は除く

問題

Affected Jira Service Management versions in CVE-2019-14994 will allow non-application access users - Service Management Customers to path traverse to see restricted issues in the Jira instance.

This allows Service Management Customers who normally don't have access to tickets that are not their own to view details of tickets contained in the XML generated results in all Jira Service Management projects.

Jira Software and Core projects will be affected if their Browse Project permission is set to Group - Anyone.

影響バージョン

  • All versions before 3.9.16

  • 3.10.x

  • 3.11.x

  • 3.12.x

  • 3.13.x

  • 3.14.x

  • 3.15.x

  • 3.16.x before 3.16.8 (the fixed version for 3.16.x)

  • 4.0.x

  • 4.1.x before 4.1.3 (the fixed version for 4.1.x)

  • 4.2.x before 4.2.5 (the fixed version for 4.2.x)

  • 4.3.x before 4.3.4 (the fixed version for 4.3.x)

  • 4.4.0


Permanent resolution below along with workarounds if immediate upgrade is not possible

ソリューション

Upgrade to fixed version of Jira Service Management

  • 3.9.16

  • 3.16.8

  • 4.1.3

  • 4.2.5

  • 4.3.4

  • 4.4.1

回避策

Block path traversals or limit tickets from Jira Software/Core projects.

Workaround to stop Jira Software/Core project returned in the resulting XML

Set all Jira Software/Core projects' Browse Project permission to certain groups

  1. Go to Project Settings → Permissions
  2. Set Browse Project permission to groups that should only have access to their respective Jira Software/Core projects.

Workaround 1.

Redirect requests to Jira containing .. to a safe URL

  1. Add the following to the <urlrewrite> section of [jira-installation-directory]/atlassian-jira/WEB-INF/urlrewrite.xml:

    <rule>
        <from>(?s)^/.*\.\..*$</from>
        <to type="temporary-redirect">/</to>
    </rule>
  2. urlrewrite.xml を保存します。
  3. Jira を再起動します。

Workaround 2.

Block requests to Jira containing .. at the reverse proxy or load balancer level

Apache

  1. Add the following into the .conf file that contains the virtualhost that proxies to Jira

    <LocationMatch "/(.*\.\.)">
       Order Allow,Deny
        Deny from  all
    </LocationMatch>

    example below -

    <VirtualHost *:80>
        ServerName jira.example.com
    
        ProxyRequests Off
        ProxyVia Off
    
        <Proxy *>
             Require all granted
        </Proxy>
        ProxyPass /jira  http://ipaddress:8080/jira
        ProxyPassReverse /jira  http://ipaddress:8080/jira
    
        <LocationMatch "/(.*\.\.)">
         Order Allow,Deny
         Deny from  all
        </LocationMatch>
    
    </VirtualHost>
  2. Restart your Apache proxy

NGINX

  1. Add the following into the .conf file that contains the server block that proxies to Jira inside location block

    if ($uri ~* "/.*\.\."){   return 405;}

    example below -

        location /jira {
            proxy_set_header X-Forwarded-Host $host;
            proxy_set_header X-Forwarded-Server $host;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass http://ipaddress:8080/jira;
            client_max_body_size 10M;
    
            if ($uri ~* "/.*\.\."){   return 405;}
         }
  2. Restart your NGINX


説明 CVE-2019-14994
製品Jira Service Management

最終更新日 2021 年 6 月 22 日

この内容はお役に立ちましたか?

はい
いいえ
この記事についてのフィードバックを送信する
Powered by Confluence and Scroll Viewport.