Jira & Confluence
Last updated
Last updated
Learn & practice AWS Hacking: Learn & practice GCP Hacking:
If you are interested in hacking career and hack the unhackable - we are hiring! (fluent polish written and spoken required).
In Jira, privileges can be checked by any user, authenticated or not, through the endpoints /rest/api/2/mypermissions
or /rest/api/3/mypermissions
. These endpoints reveal the user's current privileges. A notable concern arises when non-authenticated users hold privileges, indicating a security vulnerability that could potentially be eligible for a bounty. Similarly, unexpected privileges for authenticated users also highlight a vulnerability.
ADD_COMMENTS
ADMINISTER
ADMINISTER_PROJECTS
ASSIGNABLE_USER
ASSIGN_ISSUES
BROWSE_PROJECTS
BULK_CHANGE
CLOSE_ISSUES
CREATE_ATTACHMENTS
CREATE_ISSUES
CREATE_PROJECT
CREATE_SHARED_OBJECTS
DELETE_ALL_ATTACHMENTS
DELETE_ALL_COMMENTS
DELETE_ALL_WORKLOGS
DELETE_ISSUES
DELETE_OWN_ATTACHMENTS
DELETE_OWN_COMMENTS
DELETE_OWN_WORKLOGS
EDIT_ALL_COMMENTS
EDIT_ALL_WORKLOGS
EDIT_ISSUES
EDIT_OWN_COMMENTS
EDIT_OWN_WORKLOGS
LINK_ISSUES
MANAGE_GROUP_FILTER_SUBSCRIPTIONS
MANAGE_SPRINTS_PERMISSION
MANAGE_WATCHERS
MODIFY_REPORTER
MOVE_ISSUES
RESOLVE_ISSUES
SCHEDULE_ISSUES
SET_ISSUE_SECURITY
SYSTEM_ADMIN
TRANSITION_ISSUES
USER_PICKER
VIEW_AGGREGATED_DATA
VIEW_DEV_TOOLS
VIEW_READONLY_WORKFLOW
VIEW_VOTERS_AND_WATCHERS
WORK_ON_ISSUES
Example: https://your-domain.atlassian.net/rest/api/2/mypermissions?permissions=BROWSE_PROJECTS,CREATE_ISSUES,ADMINISTER_PROJECTS
This is an example of the macro plugin type:
It's possible to observe that these plugins might be vulnerable to common web vulnerabilities like XSS. For example the previous example is vulnerable because it's reflecting data given by the user.
These are some of the actions a malicious plugin could perform:
Hiding Plugins from Admins: It's possible to hide the malicious plugin injecting some front-end javascript
Exfiltrating Attachments and Pages: Allow to access and exfiltrate all the data.
Stealing Session Tokens: Add an endpoint that will echo the headers in the response (with the cookie) and some javascript that will contact it and leak the cookies.
Command Execution: Ofc it's possible to create a plugin that will execute code.
Reverse Shell: Or get a reverse shell.
DOM Proxying: If the confluence is inside a private network, it would be possible to establish a connection through the browser of some user with access to it and for example contact the server command executing through it.
If you are interested in hacking career and hack the unhackable - we are hiring! (fluent polish written and spoken required).
An important update was made on 1st February 2019, requiring the 'mypermissions' endpoint to include a 'permission' parameter. This requirement aims to enhance security by specifying the privileges being queried:
As indicated in this , in the documentation about it's possible to check the different types of plugins, like:
: Expose RESTful API endpoints
: Deploy Java servlets as part of a plugin
: Implement Confluence Macros, i.e. parameterised HTML templates
Once a XSS is found, in you can find some payloads to increase the impact of the XSS.
describes different (malicious) actions that could perform a malicious Jira plugin. You can find .
Learn & practice AWS Hacking: Learn & practice GCP Hacking:
Check the !
Join the 💬 or the or follow us on Twitter 🐦 .
Share hacking tricks by submitting PRs to the and github repos.